MALICIOUS — 73c254_d7ed6a264d0c448398bf461ce1465cfa.pdf

MALICIOUS — 73c254_d7ed6a264d0c448398bf461ce1465cfa.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: c2bc6b768cbe67b104e2878625913ab2468108fe393917928f6833257d92c70e
• SHA-1: 247829e5709e1c5494a134bcab541fcacba3fef9
• MD5: ac209d8bbdc485c2f018562cda4dde5f
• ssdeep: 768:tCgGzpD9g8oKDI6zX8uBMeR2g/y/XYXvzbrvzh4hPfCCnTbiMclRjXNgNMKZ:FGFxN5PP2g/iCexjnNMKZ
• TLSH: T17033BFF3209BFD8C3D8A9B076D96004A5056E3C87236A7A0558DB7BDC07C6ADBF50820
• Submitted as: 73c254_d7ed6a264d0c448398bf461ce1465cfa.pdf
• File type: pdf · Size: 50989 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=manhattan+gmat+complete+strategy+guide+set+6th+edition+pdf+download, http://files.kennetgospelhall.org/uploads/1/3/0/7/130775892/2320813.pdf, http://files.easternshorechess.com/uploads/1/3/1/4/131483584/pekizureb_zabixi_mapof_menuk.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=manhattan+gmat+complete+strategy+guide+set+6th+edition+pdf+download
• http://files.kennetgospelhall.org/uploads/1/3/0/7/130775892/2320813.pdf
• http://files.easternshorechess.com/uploads/1/3/1/4/131483584/pekizureb_zabixi_mapof_menuk.pdf
• http://zupeko.ekohaus.lt/uploads/1/3/1/3/131398591/1824800.pdf
• http://wavilez.sbednarski.net/uploads/1/3/1/6/131636725/fb29cf.pdf
• http://files.krethcattle.com/uploads/1/3/1/0/131070137/miwurejajesaj_sevirepuja.pdf
• http://gowibevu.frackfreefoothills.net/uploads/1/3/0/9/130969265/kuzajikoxajenewibiza.pdf
• http://vadonoz.dltigomez.com/uploads/1/3/1/4/131453028/diwozakezijew-kifir-nugegiwutoni-lafede.pdf
• https://9250fe52-20cd-4000-9573-0d8c06e64180.filesusr.com/ugd/70c1ec_7d2bf8fd83fb4ccaa151b38bfb2ee4a3.pdf?index=true
• https://3caa5ecb-5b49-4779-b293-108c6eb9e5d6.filesusr.com/ugd/93c935_8bf7b4e76f1849d4a704484f4df0e0ad.pdf?index=true
• https://39631599-c222-4c48-92c0-6cc8022ca34f.filesusr.com/ugd/9d869b_8e8b9d329bd44b67b4170f0d072a3887.pdf?index=true
• https://9c6f0df0-4918-4220-8be5-d4b8cc3b20b6.filesusr.com/ugd/dcf311_bfbd33e20a804fa09b269749c2a18b2e.pdf?index=true
• https://837ad8b9-6737-4c92-bcb0-fa179d6c7004.filesusr.com/ugd/e643da_bf1ddbd419244dbc97f84ea690ae49cd.pdf?index=true
• https://cdn.shopify.com/s/files/1/0444/6171/9719/files/savannah_tv_schedule.pdf
• https://cdn.shopify.com/s/files/1/0435/8311/1336/files/didibabaxodipekosusedes.pdf
• https://cdn.shopify.com/s/files/1/0436/8554/4089/files/56076822780.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• files.kennetgospelhall.org
• files.easternshorechess.com
• wavilez.sbednarski.net
• files.krethcattle.com
• gowibevu.frackfreefoothills.net
• vadonoz.dltigomez.com
• 9250fe52-20cd-4000-9573-0d8c06e64180.filesusr.com
• 3caa5ecb-5b49-4779-b293-108c6eb9e5d6.filesusr.com
• 39631599-c222-4c48-92c0-6cc8022ca34f.filesusr.com
• 9c6f0df0-4918-4220-8be5-d4b8cc3b20b6.filesusr.com
• 837ad8b9-6737-4c92-bcb0-fa179d6c7004.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com
• zupeko.ekohaus.lt

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report