MALICIOUS — eb6612_ea5ac250644647c5b5b345f84a7feb75.pdf

MALICIOUS — eb6612_ea5ac250644647c5b5b345f84a7feb75.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: c1afd1ab7a826b175b3264c399928b3232d41e2451269b235fd13648fdff235a
• SHA-1: c20fc20acbe48905d0c06151db33d694aa821c4f
• MD5: 154b63f81d6f37216c6c9dfced216975
• ssdeep: 768:RgGzpD1dWRGrcPrFENvSCOOIVeAw4xULMrv2sycq+vPH8NGagWyHYG0i:iGFBQXjOIVehEYMQcq+vPHQgWyHYG0i
• TLSH: T1A9329EF35093ED8C3ADB5F03AEEA11996085C68E6176A2741589733CC4BC6FD6E00A71
• Submitted as: eb6612_ea5ac250644647c5b5b345f84a7feb75.pdf
• File type: pdf · Size: 46542 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=itunes+gift+card+balance+without+redeeming, http://files.danyeldevilliers.com/uploads/1/3/0/8/130874134/dabokod.pdf, http://files.especiallyforyou1.com/uploads/1/3/1/4/131483317/e8a166bd9b23ec.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=itunes+gift+card+balance+without+redeeming
• http://files.danyeldevilliers.com/uploads/1/3/0/8/130874134/dabokod.pdf
• http://files.especiallyforyou1.com/uploads/1/3/1/4/131483317/e8a166bd9b23ec.pdf
• http://fotav.lisasporte.com/uploads/1/3/0/9/130969358/ad9c7.pdf
• http://files.mezzinophotography.com/uploads/1/3/0/8/130874451/d35cc08f7d8e8.pdf
• http://files.astablaksiberians.com/uploads/1/3/0/7/130739742/b2a1e.pdf
• https://f6e319a4-713a-483d-b235-f73977ff8f3b.filesusr.com/ugd/974a4e_5a74700a305941d9a01613f9387fe289.pdf?index=true
• https://d522f603-8341-4957-8ca8-22daf348534a.filesusr.com/ugd/eb6612_861f506771ef46f383022850a081eeb6.pdf?index=true
• https://588c4f28-f06e-4085-882e-939ca294e987.filesusr.com/ugd/c722c2_396cdfae73114d20885f57f9881c3eb0.pdf?index=true
• https://1398cfc9-232d-4419-be97-da0fa905dff8.filesusr.com/ugd/5bb01c_abe4b2f2a18b4415b27735d9b50d8d81.pdf?index=true
• https://cdn.shopify.com/s/files/1/0432/2826/6654/files/bulozigigazipekulaf.pdf
• https://cdn.shopify.com/s/files/1/0432/3858/8584/files/backdoor_attack.pdf
• https://cdn.shopify.com/s/files/1/0438/7949/7896/files/vorasedoretewuxe.pdf
• https://1877303a-f808-11ea-a328-fc4dd43d38a6.filesusr.com/ugd/a86d68_96f8f33e8a4d415d8bc2e34d797d11eb.pdf?index=true
• https://bdeeb94d-6e2e-46e7-aca6-da0c6e6c8841.filesusr.com/ugd/b463f2_f1cb1c406d1f45cd825feeb287e099cf.pdf?index=true
• https://9f38e598-0eb6-4ab4-b425-6297cbffd2b3.filesusr.com/ugd/33ab24_acceefce51404c91b79c8c3a8bb9fb81.pdf?index=true
• https://04f581e7-da1f-4b43-b352-452121160611.filesusr.com/ugd/0b46e6_f6585cd5c920478d995134440207e5cf.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• files.danyeldevilliers.com
• files.especiallyforyou1.com
• fotav.lisasporte.com
• files.mezzinophotography.com
• files.astablaksiberians.com
• f6e319a4-713a-483d-b235-f73977ff8f3b.filesusr.com
• d522f603-8341-4957-8ca8-22daf348534a.filesusr.com
• 588c4f28-f06e-4085-882e-939ca294e987.filesusr.com
• 1398cfc9-232d-4419-be97-da0fa905dff8.filesusr.com
• cdn.shopify.com
• 1877303a-f808-11ea-a328-fc4dd43d38a6.filesusr.com
• bdeeb94d-6e2e-46e7-aca6-da0c6e6c8841.filesusr.com
• 9f38e598-0eb6-4ab4-b425-6297cbffd2b3.filesusr.com
• 04f581e7-da1f-4b43-b352-452121160611.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report