MALICIOUS — 18ee90_1c93ce2085ea4a50bc19518981dc1924.pdf

MALICIOUS — 18ee90_1c93ce2085ea4a50bc19518981dc1924.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: ddd8219d482a49e8cfecc7be895e6cf30c16f375586516a807cf8bd62c216d90
• SHA-1: e384de95b8ea3bbc5848e55251c47c75929b5bd8
• MD5: 95056bb7c083f5666060ce483ef35404
• ssdeep: 768:7gGzpD9m7WHPKKW/GWW+/jQ4BB44JdCgsMp2pTMQ:EGFp4KWnW+/ja4HCgVp2pTMQ
• TLSH: T1B4319EF310A7CD8C7AC3AB03AEDB20697089E7486227A6A554DC776CC47C3BD6E00561
• Submitted as: 18ee90_1c93ce2085ea4a50bc19518981dc1924.pdf
• File type: pdf · Size: 41434 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=geuda+springs+ks+weather, https://80c73fdf-e194-42d8-b2ca-f830b9fecee9.filesusr.com/ugd/c5d40f_017abec0bd7f4af8bc71ca29d5b9b5e2.pdf?index=true, https://04f581e7-da1f-4b43-b352-452121160611.filesusr.com/ugd/0b46e6_f6585cd5c920478d995134440207e5cf.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=geuda+springs+ks+weather
• https://80c73fdf-e194-42d8-b2ca-f830b9fecee9.filesusr.com/ugd/c5d40f_017abec0bd7f4af8bc71ca29d5b9b5e2.pdf?index=true
• https://04f581e7-da1f-4b43-b352-452121160611.filesusr.com/ugd/0b46e6_f6585cd5c920478d995134440207e5cf.pdf?index=true
• https://e0430fcd-33a4-4490-9e82-a412e1bb08db.filesusr.com/ugd/e3c460_25495d0557d04aab9b2001fd45989bc5.pdf?index=true
• https://31938a77-109f-49ce-b8ce-0ac01bf62ef3.filesusr.com/ugd/8e6e76_4d1e1ed227ee47a5ad05d4bd8e573d44.pdf?index=true
• https://65b2666b-0832-4de0-8abc-2fa5bbdda390.filesusr.com/ugd/5f226b_f98074d99dda4fd6827b1e49049af16c.pdf?index=true
• https://c93ceda7-4009-46b2-8421-880125a843a3.filesusr.com/ugd/ce14f3_79befbb6f80d4a2eb42e2ba10b2ae5d9.pdf?index=true
• https://4715a824-093c-4b79-ab59-84682a104e86.filesusr.com/ugd/76dd3d_b3e1a5ea47ea41f88588e25df1549d96.pdf?index=true
• http://files.wordsfromsue.com/uploads/1/3/2/6/132680933/wosanefuwuzela_newejokufeto_sokowekek.pdf
• http://binetuso.middleschoollegion.org/uploads/1/3/0/7/130776330/0468368b70ec5.pdf
• http://files.ilcpr.com/uploads/1/3/1/3/131378852/55423fd01ad.pdf
• http://relaxikox.joneruizguitarlessons.com/uploads/1/3/1/1/131164319/kazedesus-zimojukomija.pdf
• https://1fd1eef7-8943-4434-a8a5-91a8dee368f8.filesusr.com/ugd/e1c37d_847863fb534f4fef8b9eca40ca89f644.pdf?index=true
• https://1a622f17-8516-4c3f-8086-b6439fd5bcdb.filesusr.com/ugd/8e6e76_204f8e70374d489abdb710fff080b9c9.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• 80c73fdf-e194-42d8-b2ca-f830b9fecee9.filesusr.com
• 04f581e7-da1f-4b43-b352-452121160611.filesusr.com
• e0430fcd-33a4-4490-9e82-a412e1bb08db.filesusr.com
• 31938a77-109f-49ce-b8ce-0ac01bf62ef3.filesusr.com
• 65b2666b-0832-4de0-8abc-2fa5bbdda390.filesusr.com
• c93ceda7-4009-46b2-8421-880125a843a3.filesusr.com
• 4715a824-093c-4b79-ab59-84682a104e86.filesusr.com
• files.wordsfromsue.com
• binetuso.middleschoollegion.org
• files.ilcpr.com
• relaxikox.joneruizguitarlessons.com
• 1fd1eef7-8943-4434-a8a5-91a8dee368f8.filesusr.com
• 1a622f17-8516-4c3f-8086-b6439fd5bcdb.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report