MALICIOUS — f08e01_328b91c2448e4abc88b32fcbd6221717.pdf

MALICIOUS — f08e01_328b91c2448e4abc88b32fcbd6221717.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: d77d313877119e4b4ff29102d5020b1dde8c86e35a653e5d55aa098a5dfb4f9f
• SHA-1: 1b0e29a2b5bfa5f807562684955ae9534295591a
• MD5: 2b6c02f83cffc6fc5121d2b10b1124fd
• ssdeep: 768:ugGzpD6nsrNumhtU9WJk5e7MtkbCdQmoWF0+Xl:LGFWUvI5NtkmrjF0+Xl
• TLSH: T142319DF3105BED4C6B8B9F076DAA149CB1059A8D723682A419D87B3CC9BC1FCAF40560
• Submitted as: f08e01_328b91c2448e4abc88b32fcbd6221717.pdf
• File type: pdf · Size: 39326 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=scouts+guide+zombie+soundtrack, https://8d0a40df-7f86-4e8b-856c-a71353619c1a.filesusr.com/ugd/5bb01c_fe8dd4b5a17f45298fad8f44b041d4fa.pdf?index=true, https://f4d72857-9808-44eb-971d-967bc272c079.filesusr.com/ugd/7a13df_8423c8ada10f40a99b863f34c8737fd5.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=scouts+guide+zombie+soundtrack
• https://8d0a40df-7f86-4e8b-856c-a71353619c1a.filesusr.com/ugd/5bb01c_fe8dd4b5a17f45298fad8f44b041d4fa.pdf?index=true
• https://f4d72857-9808-44eb-971d-967bc272c079.filesusr.com/ugd/7a13df_8423c8ada10f40a99b863f34c8737fd5.pdf?index=true
• https://61c6c16e-cecf-452b-9669-ea6585d08a24.filesusr.com/ugd/d6af85_f3e126c82ee848cd84b25b361727f791.pdf?index=true
• http://files.glencoechurchofchrist.com/uploads/1/3/1/6/131636589/pewelevopepafaw.pdf
• http://pulal.kipandfriends.com/uploads/1/3/2/8/132814007/42f5246a11.pdf
• http://files.knaoknits.co.uk/uploads/1/3/2/6/132695734/risoduzusud.pdf
• https://4d87a06e-aa10-46c6-be33-8766c83e166c.filesusr.com/ugd/e948c1_4da14832bf214f59a4ae0676f17bd173.pdf?index=true
• https://22718d98-2d2c-4828-b0f0-0fd1887ec2a2.filesusr.com/ugd/f08e01_b4a35b42a3b44146aa1258568acb34ca.pdf?index=true
• https://1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com/ugd/227d0f_f21861fd7cd84aa7b9b29a8b14cd40ef.pdf?index=true
• https://cdn.shopify.com/s/files/1/0461/9999/6569/files/42029439655.pdf
• https://cdn.shopify.com/s/files/1/0429/8588/1759/files/84451316593.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• 8d0a40df-7f86-4e8b-856c-a71353619c1a.filesusr.com
• f4d72857-9808-44eb-971d-967bc272c079.filesusr.com
• 61c6c16e-cecf-452b-9669-ea6585d08a24.filesusr.com
• files.glencoechurchofchrist.com
• pulal.kipandfriends.com
• files.knaoknits.co.uk
• 4d87a06e-aa10-46c6-be33-8766c83e166c.filesusr.com
• 22718d98-2d2c-4828-b0f0-0fd1887ec2a2.filesusr.com
• 1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report