MALICIOUS — 694d5d_67fdc543981b4b94b16ab83a138fc41f.pdf

MALICIOUS — 694d5d_67fdc543981b4b94b16ab83a138fc41f.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: c290498c73be5ef1ec12536151cc722c806fd15d1560379c046d4507c5a7716e
• SHA-1: aa053ccf8c93be2c91859655795b0c42158a3429
• MD5: bb3cb04b743832fd277c1896832020cf
• ssdeep: 768:YgGzpDrgzVEp4LR8Xv8A6UUKbxa2zTsXmKHnGA7T+uD/EUSsq8p9KEJMP4c:1GFfwG4mTsXCA7T+uzBSsXpdJMP4c
• TLSH: T1A531AEF354D7EC8C2ACB9B07AEE311592189C68EA023A774549C376CD4AC1BC7E50971
• Submitted as: 694d5d_67fdc543981b4b94b16ab83a138fc41f.pdf
• File type: pdf · Size: 40427 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.PDF.Agent.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.PDF.Agent.gen (rule HEUR:Trojan.PDF.Agent.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=how+to+open+a+gameboy+game, https://ff90179f-87bb-422a-b02d-c5885a53b47b.filesusr.com/ugd/dec231_08fdb700553949e6a837cebe5e02f263.pdf?index=true, https://f89c9433-75eb-4e86-90f6-61ef89f4a7e5.filesusr.com/ugd/370021_d50f821724264002ab3a7516c7df828a.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=how+to+open+a+gameboy+game
• https://ff90179f-87bb-422a-b02d-c5885a53b47b.filesusr.com/ugd/dec231_08fdb700553949e6a837cebe5e02f263.pdf?index=true
• https://f89c9433-75eb-4e86-90f6-61ef89f4a7e5.filesusr.com/ugd/370021_d50f821724264002ab3a7516c7df828a.pdf?index=true
• https://bdac1dba-840b-4b1d-8b2a-88849bd7683d.filesusr.com/ugd/c83fdb_2ec38bf61aa74dbd9c0e427ecf6b8ae2.pdf?index=true
• https://cb6e6c7e-34b4-45e6-8d63-53fcba4cc475.filesusr.com/ugd/8a05ec_ddb939a2983c46309cb63c1925121b42.pdf?index=true
• https://d1187b99-b591-4815-be1c-605f9140273a.filesusr.com/ugd/bca722_90e5a6280486406aa46ac63a22b67ca0.pdf?index=true
• https://cdn.shopify.com/s/files/1/0440/3894/6981/files/dutuluzubowotiko.pdf
• https://cdn.shopify.com/s/files/1/0433/7421/5331/files/ranib.pdf
• https://cdn.shopify.com/s/files/1/0439/6787/3182/files/tixetunut.pdf
• https://cdn.shopify.com/s/files/1/0431/2439/2087/files/96501320280.pdf
• https://9bee69c3-ca75-4ee1-9b12-624e8484e4ca.filesusr.com/ugd/89441e_11122278833c49129f6c820ceb330164.pdf?index=true
• https://aae6e6d0-a540-4b63-a0dc-69a931174af2.filesusr.com/ugd/dcf9ad_7a2faa220c064e50b5c90906a054d837.pdf?index=true
• https://57fad6f6-8431-4340-9d3a-899b1755e0fa.filesusr.com/ugd/7f5dc5_c93a1c175fe64e2d83db152db5a624cf.pdf?index=true
• https://146dee01-328c-4163-ad4e-394869d7c9de.filesusr.com/ugd/b926a8_6bc97925929c42e9972991381cbb8f39.pdf?index=true
• https://ebdc77ac-c9da-4b46-8ba7-1fee8f80434e.filesusr.com/ugd/405339_01bd02ba8be24fdab5f9bde864c397ea.pdf?index=true
• https://f79c594c-eac2-4186-8492-fae013a4db4b.filesusr.com/ugd/78daac_b28bece317a547cc8e273602c5c252f4.pdf?index=true
• https://d013910e-b479-4e70-8c1c-9c11c4f65daa.filesusr.com/ugd/145364_de1843baaf2447e8b2940461c4df2c1d.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• ff90179f-87bb-422a-b02d-c5885a53b47b.filesusr.com
• f89c9433-75eb-4e86-90f6-61ef89f4a7e5.filesusr.com
• bdac1dba-840b-4b1d-8b2a-88849bd7683d.filesusr.com
• cb6e6c7e-34b4-45e6-8d63-53fcba4cc475.filesusr.com
• d1187b99-b591-4815-be1c-605f9140273a.filesusr.com
• cdn.shopify.com
• 9bee69c3-ca75-4ee1-9b12-624e8484e4ca.filesusr.com
• aae6e6d0-a540-4b63-a0dc-69a931174af2.filesusr.com
• 57fad6f6-8431-4340-9d3a-899b1755e0fa.filesusr.com
• 146dee01-328c-4163-ad4e-394869d7c9de.filesusr.com
• ebdc77ac-c9da-4b46-8ba7-1fee8f80434e.filesusr.com
• f79c594c-eac2-4186-8492-fae013a4db4b.filesusr.com
• d013910e-b479-4e70-8c1c-9c11c4f65daa.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report