MALICIOUS — 3f0e57_f70f170d4385436f81424beb90ccc429.pdf

MALICIOUS — 3f0e57_f70f170d4385436f81424beb90ccc429.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: ceb705588c53e488bde5c6b5511bda89acad56dec577d8b7279c73f6a0696a77
• SHA-1: 98be13a89c79596ea1cf45014b0ddb703ab7a653
• MD5: e647c6a800037a551fa2bfb7f8ce2a8a
• ssdeep: 768:2gGzpDAfQvKSzKwBq7m9eKmskEhqNX9vCuDrumNHRxvXP7S:jGFkZKmskEhqNt1jxvXP7S
• TLSH: T1022F7DF31497EC4C7A8B9F03ADAB26595189D7C86133E760588C376CD4BC2BCAE40961
• Submitted as: 3f0e57_f70f170d4385436f81424beb90ccc429.pdf
• File type: pdf · Size: 35427 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=lg+dley1701v+manual, https://15783b36-dfb9-4985-98aa-aacf8cafcc27.filesusr.com/ugd/f08e01_4846cf75986a4b6cb8384929c66e3659.pdf?index=true, https://a2c6641e-11ce-4361-93e4-ddeaaa7bea20.filesusr.com/ugd/81d6a4_de5d508cebea4111b9b40363ea7cdf2c.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=lg+dley1701v+manual
• https://15783b36-dfb9-4985-98aa-aacf8cafcc27.filesusr.com/ugd/f08e01_4846cf75986a4b6cb8384929c66e3659.pdf?index=true
• https://a2c6641e-11ce-4361-93e4-ddeaaa7bea20.filesusr.com/ugd/81d6a4_de5d508cebea4111b9b40363ea7cdf2c.pdf?index=true
• https://29b5993a-e9c0-4f8e-af93-6ed027d30e9e.filesusr.com/ugd/cc3ca9_674575c3d95b42bda2bc19c9c717aed4.pdf?index=true
• https://a1128058-9273-49c9-92b8-71f1d14012db.filesusr.com/ugd/9058e5_536fe6da796c4238abdc1bf998f846f2.pdf?index=true
• http://fuwuvabu.clubpizza.net/uploads/1/3/0/8/130814761/1629823.pdf
• http://files.maxinewade.com/uploads/1/3/1/4/131437056/2525309.pdf
• http://files.the-westwood-wire.info/uploads/1/3/1/4/131437254/8942002.pdf
• http://files.bopscifair.org.nz/uploads/1/3/1/4/131454523/piweliwanugisojato.pdf
• http://kogupugo.tessalynnebook.com/uploads/1/3/0/7/130775778/4402210.pdf
• https://cdn.shopify.com/s/files/1/0481/1725/2249/files/suzuki_samurai_bike_olx.pdf
• https://cdn.shopify.com/s/files/1/0440/5267/6773/files/reformed_baptist_churches_near_me.pdf
• https://cdn.shopify.com/s/files/1/0437/5176/8225/files/verbal_judo_summary.pdf
• https://cdn.shopify.com/s/files/1/0440/7784/2584/files/faxusexixodevaxoludenafuk.pdf
• https://cdn.shopify.com/s/files/1/0437/0386/1416/files/nefejo.pdf
• https://cdn.shopify.com/s/files/1/0467/5498/8195/files/zuruvoduti.pdf
• https://cdn.shopify.com/s/files/1/0431/8353/8331/files/80494588293.pdf
• https://cdn.shopify.com/s/files/1/0434/2287/5797/files/agrarian_reform_law_book.pdf
• https://cdn.shopify.com/s/files/1/0440/1859/8053/files/gudotat.pdf
• https://cdn.shopify.com/s/files/1/0427/4513/5260/files/7608828522.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/

Embedded domains

• ttraff.club
• 15783b36-dfb9-4985-98aa-aacf8cafcc27.filesusr.com
• a2c6641e-11ce-4361-93e4-ddeaaa7bea20.filesusr.com
• 29b5993a-e9c0-4f8e-af93-6ed027d30e9e.filesusr.com
• a1128058-9273-49c9-92b8-71f1d14012db.filesusr.com
• fuwuvabu.clubpizza.net
• files.maxinewade.com
• files.the-westwood-wire.info
• kogupugo.tessalynnebook.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com
• files.bopscifair.org.nz

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report