MALICIOUS — a31856_f1491198e4ad4e2f8def192dd6185639.pdf

MALICIOUS — a31856_f1491198e4ad4e2f8def192dd6185639.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: d0c7386c2bd9752991eae893534a1dbac91cbed9c58786474eae2bd46d2b4c58
• SHA-1: bdfd5a801144ccfad456da4fd96dd30941662cd6
• MD5: 2fd487d45eab5ef89490cac859d9d4c5
• ssdeep: 768:EgGzpDbI5M5M8sP+RA5Ek2tGzylhZFTwourpkPi:xGFPI+ODvyNFTwourpkPi
• TLSH: T121308EF34057DD8D3AC9AF036EA7155E2187C64DB132AA6015DC7B2CC47C6BC2E40AA1
• Submitted as: a31856_f1491198e4ad4e2f8def192dd6185639.pdf
• File type: pdf · Size: 35880 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=sirs+2020+jeddah, http://files.christinecarson.net/uploads/1/3/0/9/130969497/xowovedigaziwa.pdf, http://nudef.fitzpatrickecologicalconsulting.com/uploads/1/3/2/8/132816066/ffd60f9610d7fd.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=sirs+2020+jeddah
• http://files.christinecarson.net/uploads/1/3/0/9/130969497/xowovedigaziwa.pdf
• http://nudef.fitzpatrickecologicalconsulting.com/uploads/1/3/2/8/132816066/ffd60f9610d7fd.pdf
• http://gubuwi.treatsoflove.com/uploads/1/3/1/3/131380213/lofipiliz_mukakibasuxaki.pdf
• http://files.nestoncricketclub.co.uk/uploads/1/3/0/7/130739919/garovofaf_degexegifazit_zonugidekomak_sefego.pdf
• http://files.calgarycigars.com/uploads/1/3/1/6/131606968/matatewitidijovup.pdf
• https://cdn.shopify.com/s/files/1/0431/7118/4794/files/matematik_bilesik_faiz_formulu.pdf
• https://cdn.shopify.com/s/files/1/0434/2490/7414/files/sosukibepazesola.pdf
• https://cdn.shopify.com/s/files/1/0461/8174/4793/files/biblical_character_traits_chart.pdf
• https://cdn.shopify.com/s/files/1/0435/2406/3392/files/44438654475.pdf
• https://cdn.shopify.com/s/files/1/0432/3786/7687/files/2017_audi_a4_manual_0-_60.pdf
• https://cdn.shopify.com/s/files/1/0429/9377/8837/files/4062232218.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• files.christinecarson.net
• nudef.fitzpatrickecologicalconsulting.com
• gubuwi.treatsoflove.com
• files.nestoncricketclub.co.uk
• files.calgarycigars.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report