MALICIOUS — 60802742971.pdf

MALICIOUS — 60802742971.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (70/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: c5a4567418a0e189b02c6681c40bb89658a7312f98fbd06dea11511c7c8645f1
• SHA-1: 999c6493bad8746ea2dbc5efca170db993b99d6c
• MD5: f20f53bd23490e828a23f9a75ca959ba
• ssdeep: 768:2AgGzpDK0DrwVOj3lgyoQxrNLx3PyMl9m2Rz/TZrU1ZywCCeN:uGF+0Dl5rSn2Rz7y1ZypCeN
• TLSH: T15A328DF35497ECDC3B86DB0359FA25555146DB8D2232E6648AC87B2CC87C3BCAE40960
• Submitted as: 60802742971.pdf
• File type: pdf · Size: 44483 bytes
• Verdict: malicious (70/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 70/100 is the fusion of 4 weighted signals:

• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=english+alphabets+in+different+styles+pdf, http://legagiru.zenvapour.co.uk/uploads/1/3/1/6/131607131/1c56482bb82.pdf, http://files.juliaandjustjulia.co/uploads/1/3/1/4/131453194/gusokipa.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ggtraff.ru/strik?keyword=english+alphabets+in+different+styles+pdf
• http://legagiru.zenvapour.co.uk/uploads/1/3/1/6/131607131/1c56482bb82.pdf
• http://files.juliaandjustjulia.co/uploads/1/3/1/4/131453194/gusokipa.pdf
• http://favifav.algebrahd.org/uploads/1/3/1/4/131406688/2244414.pdf
• https://site-1037114.mozfiles.com/files/1037114/sipezazizefel.pdf
• https://site-1036800.mozfiles.com/files/1036800/3819150730.pdf
• https://site-1036876.mozfiles.com/files/1036876/pidejuzufogunul.pdf
• https://site-1038529.mozfiles.com/files/1038529/11661211585.pdf
• https://cdn.shopify.com/s/files/1/0431/1125/2132/files/99446412561.pdf
• https://cdn.shopify.com/s/files/1/0482/8738/3716/files/forks_over_knives_answers.pdf
• https://cdn.shopify.com/s/files/1/0437/7824/4765/files/lg_oled_b8_tv_manual.pdf
• http://seriwe.huffmansflowersofthefield.com/uploads/1/3/0/7/130739892/jopegutoro.pdf
• http://files.reikifortheplanet.com/uploads/1/3/1/8/131857916/2263622.pdf
• http://files.revotechnologies.net/uploads/1/3/0/7/130738962/tuzesemesis.pdf
• http://files.fhwellness-ca.com/uploads/1/3/2/3/132302940/vejoxisajefolet.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• legagiru.zenvapour.co.uk
• files.juliaandjustjulia.co
• favifav.algebrahd.org
• site-1037114.mozfiles.com
• site-1036800.mozfiles.com
• site-1036876.mozfiles.com
• site-1038529.mozfiles.com
• cdn.shopify.com
• seriwe.huffmansflowersofthefield.com
• files.reikifortheplanet.com
• files.revotechnologies.net
• files.fhwellness-ca.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report