MALICIOUS — 26481d_1e230acf771b41e1a320354d3ccf89c6.pdf

MALICIOUS — 26481d_1e230acf771b41e1a320354d3ccf89c6.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: e27be56441e059404123be620ec8273c6420a704cebbc5154ef639bb2d206c12
• SHA-1: d4fcbc3466290c16e1e7906e77726d99a22dfa2b
• MD5: f19b7036e91a225c1b18489ce13431e4
• ssdeep: 768:EgGzpD1bwH7QMFGx8t7tgKjpZG7IvTAfVTmPZ4L4fLFvADz:xGFJZE7tgKjTBcRmPZ4LEADz
• TLSH: T1D732A0F72097EC4C7A8B2B07AAEB015E6484C68D71379A6455C83B2CD4FC6FD6E00925
• Submitted as: 26481d_1e230acf771b41e1a320354d3ccf89c6.pdf
• File type: pdf · Size: 46183 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=the+people+of+sparks+movie, https://0f5d40d6-4d90-4736-a001-e793d4b69a3a.filesusr.com/ugd/1e52da_36b2ebb9a55c4536a045c10470c79cc1.pdf?index=true, https://5cf46b28-aa87-497d-9334-3c9d201c1762.filesusr.com/ugd/c8683e_d5c0a1b0716f4761b087b1865cbbc533.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=the+people+of+sparks+movie
• https://0f5d40d6-4d90-4736-a001-e793d4b69a3a.filesusr.com/ugd/1e52da_36b2ebb9a55c4536a045c10470c79cc1.pdf?index=true
• https://5cf46b28-aa87-497d-9334-3c9d201c1762.filesusr.com/ugd/c8683e_d5c0a1b0716f4761b087b1865cbbc533.pdf?index=true
• https://5a64510a-3352-441b-a8f7-d80ef7983014.filesusr.com/ugd/8da65f_77eb815a4aa84fce9fc489812e9fd7cf.pdf?index=true
• https://7f5a7bf3-b15b-442c-a14e-0cb3f762b7a9.filesusr.com/ugd/f2c1dc_004f7327e897450f979ad7b5548848df.pdf?index=true
• https://be4537e4-3182-4d41-a380-92084f049495.filesusr.com/ugd/771ea4_a4a2957deb6644bb80f75063f432189e.pdf?index=true
• http://files.spapelle.net/uploads/1/3/1/4/131483184/8386507.pdf
• http://xofuvez.clearlake8ball.net/uploads/1/3/1/6/131606183/3dc8f14d7494839.pdf
• http://files.greenandblueproject.com/uploads/1/3/0/8/130814534/fujoludiviwux-namanereb-kidepe-vozuxixer.pdf
• http://megetew.brookekferguson.com/uploads/1/3/1/3/131380005/66ae04c9d0.pdf
• http://files.opalmg.com/uploads/1/3/2/7/132740239/61a98c0344f.pdf
• http://zutedov.hickmanfootball.com/uploads/1/3/1/4/131438577/dapubitegisaveb.pdf
• http://webego.sbinfreedom.com/uploads/1/3/1/3/131379605/c2a3f4e.pdf
• http://files.estudiosdelaescritura.org/uploads/1/3/1/6/131606493/8894423.pdf
• http://duwudosej.ipmed.org/uploads/1/3/1/4/131406717/8510b63c2cedde.pdf
• https://cdn.shopify.com/s/files/1/0432/2961/0141/files/mepegonujepawelivisopewep.pdf
• https://cdn.shopify.com/s/files/1/0434/8909/9938/files/43587380057.pdf
• https://cdn.shopify.com/s/files/1/0433/5960/0798/files/37483222672.pdf
• https://cdn.shopify.com/s/files/1/0437/0553/2569/files/riminugipi.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• 0f5d40d6-4d90-4736-a001-e793d4b69a3a.filesusr.com
• 5cf46b28-aa87-497d-9334-3c9d201c1762.filesusr.com
• 5a64510a-3352-441b-a8f7-d80ef7983014.filesusr.com
• 7f5a7bf3-b15b-442c-a14e-0cb3f762b7a9.filesusr.com
• be4537e4-3182-4d41-a380-92084f049495.filesusr.com
• files.spapelle.net
• xofuvez.clearlake8ball.net
• files.greenandblueproject.com
• megetew.brookekferguson.com
• files.opalmg.com
• zutedov.hickmanfootball.com
• webego.sbinfreedom.com
• files.estudiosdelaescritura.org
• duwudosej.ipmed.org
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report