MALICIOUS — 83e584_e6653cc4a1eb4dc38f0423bd1a9d282a.pdf

MALICIOUS — 83e584_e6653cc4a1eb4dc38f0423bd1a9d282a.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: d064ade1c94ec7b9772b18213543ea3e72aed2796db884b0e07dbc1cc2022013
• SHA-1: 052af70f9aa89f73c32c7a81d04ceff80464514b
• MD5: 2963ec8535766537d6106709d2d37781
• ssdeep: 1536:1GFMRFGJDYbLUhId42/HjjEql5W3yEQKIuMAh:IFMRFWUJ42/XEU5W3cKIul
• TLSH: T1ED35CFF3558BDD4CBA838B139CB71151A19AD7C952329BA800C87B6CC5AC3FD6E20920
• Submitted as: 83e584_e6653cc4a1eb4dc38f0423bd1a9d282a.pdf
• File type: pdf · Size: 60706 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=papa+ge+once+on+this+island+jr, https://a58e86a3-8a74-4eb4-8e16-a40965d1838c.filesusr.com/ugd/2d1648_4b34cf842350445599a7db14ac0b4639.pdf?index=true, https://12b2a624-8c34-433b-a5aa-cccbb27ff598.filesusr.com/ugd/ccf397_dd56e59b03b847b3ad58b6d595babfb7.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=papa+ge+once+on+this+island+jr
• https://a58e86a3-8a74-4eb4-8e16-a40965d1838c.filesusr.com/ugd/2d1648_4b34cf842350445599a7db14ac0b4639.pdf?index=true
• https://12b2a624-8c34-433b-a5aa-cccbb27ff598.filesusr.com/ugd/ccf397_dd56e59b03b847b3ad58b6d595babfb7.pdf?index=true
• https://14a8f322-f6ea-46c0-8a51-465e1bbe4c8d.filesusr.com/ugd/11baf9_ff964eb6c1ed4ceebd65a07e247f7c78.pdf?index=true
• http://files.theheygroup.net/uploads/1/3/1/0/131069886/dukezafabiwaxewom.pdf
• http://gosab.nualahairdressing.com/uploads/1/3/2/6/132695399/d4dd994a46.pdf
• http://tonow.oldschoolsailing.com/uploads/1/3/1/6/131606295/zonijitekojo_xasonitamet_gilapuzenilekev_muraf.pdf
• http://tezofazag.opalfund.org/uploads/1/3/1/3/131379833/kuzobife_rojoganuto.pdf
• http://denupob.davidstraange.com/uploads/1/3/2/7/132740930/3978507.pdf
• http://files.lunagardenmontessori.com/uploads/1/3/2/6/132695832/2956747.pdf
• http://files.breaksticks.pitbullhill.com/uploads/1/3/2/6/132695424/garurewuxojunitu.pdf
• http://guxulepi.pinakainteractive.com/uploads/1/3/2/6/132682076/ruraxom.pdf
• http://tixagun.paintingsbysavage.com/uploads/1/3/1/4/131408183/02d6d43a18579e2.pdf
• https://aecd17a0-e4b1-4003-906d-d3a6cb4d5095.filesusr.com/ugd/ffe0d3_27936613da0e4f14b272fe6690d39ae6.pdf?index=true
• https://1c5ce05b-6248-4202-b6ec-44dd59e59040.filesusr.com/ugd/6f53d7_5db98e5813c941c6b98e4cfef51e0a74.pdf?index=true
• https://eb2fc0e5-3c72-428f-83ee-ac0caced3a8e.filesusr.com/ugd/221eaa_27d16db956b44ac09766a7b851e9a66b.pdf?index=true
• https://de3f174a-3a9a-493c-a591-e6ea0b1615f1.filesusr.com/ugd/a13bc2_5df7daa991cb4faca699252e56649cf2.pdf?index=true
• https://58a0bb44-8581-466b-a9a2-261713fa103a.filesusr.com/ugd/66f3f9_c3378f6462cb44f68dd81b921004e915.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• a58e86a3-8a74-4eb4-8e16-a40965d1838c.filesusr.com
• 12b2a624-8c34-433b-a5aa-cccbb27ff598.filesusr.com
• 14a8f322-f6ea-46c0-8a51-465e1bbe4c8d.filesusr.com
• files.theheygroup.net
• gosab.nualahairdressing.com
• tonow.oldschoolsailing.com
• tezofazag.opalfund.org
• denupob.davidstraange.com
• files.lunagardenmontessori.com
• files.breaksticks.pitbullhill.com
• guxulepi.pinakainteractive.com
• tixagun.paintingsbysavage.com
• aecd17a0-e4b1-4003-906d-d3a6cb4d5095.filesusr.com
• 1c5ce05b-6248-4202-b6ec-44dd59e59040.filesusr.com
• eb2fc0e5-3c72-428f-83ee-ac0caced3a8e.filesusr.com
• de3f174a-3a9a-493c-a591-e6ea0b1615f1.filesusr.com
• 58a0bb44-8581-466b-a9a2-261713fa103a.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report