MALICIOUS — 665c20_f43ab78f535a4f0b9a4032807b7a20f1.pdf

MALICIOUS — 665c20_f43ab78f535a4f0b9a4032807b7a20f1.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: dd61b2d0ba7548ea5c9b0422cb3f7d079725fc702464594d1cbc49741141ce24
• SHA-1: ae1ca5099a2ff71bc0cdc03c645ee67cea834f31
• MD5: 1c41477dd1bea3ed5698163425a84485
• ssdeep: 768:6gGzpDBe85t+I4mtdY3NAFZ1mdMfOSFQgdA+zyJ9PZZIqh6xI:nGFt9WI+Wj1mduFQgS+zyDZZj6xI
• TLSH: T1A632BEF320A7DC8C6A87DB037ED621189089DB496173A634598D3B6CC4BC2BDAF10931
• Submitted as: 665c20_f43ab78f535a4f0b9a4032807b7a20f1.pdf
• File type: pdf · Size: 46774 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=che+guevara+a+revolutionary+life+pdf, https://63ae099c-e61b-4b55-8ce8-2ce90d5324f3.filesusr.com/ugd/c1de29_4962fd8f89c44c828bee28ac0695b485.pdf?index=true, https://f328dcf4-562d-4648-8e16-1dfd52a83eec.filesusr.com/ugd/69695d_f979307bba35439885ce36b09a569c25.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=che+guevara+a+revolutionary+life+pdf
• https://63ae099c-e61b-4b55-8ce8-2ce90d5324f3.filesusr.com/ugd/c1de29_4962fd8f89c44c828bee28ac0695b485.pdf?index=true
• https://f328dcf4-562d-4648-8e16-1dfd52a83eec.filesusr.com/ugd/69695d_f979307bba35439885ce36b09a569c25.pdf?index=true
• https://b562a0ad-2a60-49fe-9e68-87c3cfe11445.filesusr.com/ugd/f1780b_dd45e29c1b4b4144a5279f6b5f5a426d.pdf?index=true
• https://e928e497-4afe-4b6e-a32b-f0a8a728b5e1.filesusr.com/ugd/e3c460_4922327e1b4d475db9e7db7878f4dd7f.pdf?index=true
• http://files.extremeimprov.co.uk/uploads/1/3/0/7/130738596/jeboxewuxunem.pdf
• http://files.domicildesign.com/uploads/1/3/0/7/130738949/jugarerebiga.pdf
• http://files.minniemightietopics.com/uploads/1/3/1/0/131070786/8027942.pdf
• http://files.mouthofasouthernrealtor.com/uploads/1/3/0/7/130738836/2207199.pdf
• http://files.christcenteredtribe.com/uploads/1/3/0/7/130776728/ce34fac5fdb.pdf
• https://ed994de9-21ce-444b-a668-33963e18ed09.filesusr.com/ugd/011e4b_f834d14715e54daeb07e2f8d4ae9abcb.pdf?index=true
• https://d82ea460-12f4-4a7e-87da-b696e0451668.filesusr.com/ugd/7f614e_ee952fd6dbac4ce8bb19aa5b41989338.pdf?index=true
• https://832496c1-4ef0-49c0-85eb-f846ce94135a.filesusr.com/ugd/e50c99_52e0813f1ec542ab85ae86d0ea61d8b8.pdf?index=true
• https://97d766c9-0313-4ff5-b3a0-90a24f0ef555.filesusr.com/ugd/c638b7_352371dd2487400996c32a0dd1c67077.pdf?index=true
• https://4c4da005-64c2-4ba0-b7ac-412d29cb141b.filesusr.com/ugd/4fb05f_dba7ca85db094484add84d3a1bc36a7e.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• 63ae099c-e61b-4b55-8ce8-2ce90d5324f3.filesusr.com
• f328dcf4-562d-4648-8e16-1dfd52a83eec.filesusr.com
• b562a0ad-2a60-49fe-9e68-87c3cfe11445.filesusr.com
• e928e497-4afe-4b6e-a32b-f0a8a728b5e1.filesusr.com
• files.extremeimprov.co.uk
• files.domicildesign.com
• files.minniemightietopics.com
• files.mouthofasouthernrealtor.com
• files.christcenteredtribe.com
• ed994de9-21ce-444b-a668-33963e18ed09.filesusr.com
• d82ea460-12f4-4a7e-87da-b696e0451668.filesusr.com
• 832496c1-4ef0-49c0-85eb-f846ce94135a.filesusr.com
• 97d766c9-0313-4ff5-b3a0-90a24f0ef555.filesusr.com
• 4c4da005-64c2-4ba0-b7ac-412d29cb141b.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report