MALICIOUS — dcc11b_70f2553d3e19477993748c6ac85046f0.pdf

MALICIOUS — dcc11b_70f2553d3e19477993748c6ac85046f0.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: e750822d7318a665ae124de098039b80525fd333c9c0dd6d4c157991f0ab08b3
• SHA-1: dbfd0fa00c7ecbe1c6f222b468c629fdf1231645
• MD5: 409977bda30ba7bc139038cb5cb6770c
• ssdeep: 768:2gGzpDmG8YzQUC7bRMRFYW8j+kiNr7THXL4GBJ65uUzKj0hrH+r1:jGFae8UCpGMjdM7jL4GeSaSr1
• TLSH: T1F631AEF3546BDDCC3A979703ADEA2099648997897133A22054CD7F6CC4B82FC6E24970
• Submitted as: dcc11b_70f2553d3e19477993748c6ac85046f0.pdf
• File type: pdf · Size: 40723 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=yu+gi+oh+duel+generation+apk+mod, https://058a7a77-6db1-4771-a462-92fd207448d1.filesusr.com/ugd/565485_ec135f0cf81c46f7af722dcff6b63370.pdf?index=true, https://0e26175e-70c9-4ea5-9f32-64e9f77fafd5.filesusr.com/ugd/3be48b_963d7ad2d4934ec38f647bed5e83a49f.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=yu+gi+oh+duel+generation+apk+mod
• https://058a7a77-6db1-4771-a462-92fd207448d1.filesusr.com/ugd/565485_ec135f0cf81c46f7af722dcff6b63370.pdf?index=true
• https://0e26175e-70c9-4ea5-9f32-64e9f77fafd5.filesusr.com/ugd/3be48b_963d7ad2d4934ec38f647bed5e83a49f.pdf?index=true
• https://ff18f29a-f807-11ea-a328-fc4dd43d38a6.filesusr.com/ugd/0cd3a8_37e3a44d9203403f950ab0ea9c5ebaa7.pdf?index=true
• https://67fbdadd-ee3e-4001-8f74-41f8f58ae3c4.filesusr.com/ugd/76aeb6_dcd6aa3ec6404cf7841238ef93e5b9b6.pdf?index=true
• https://37cd0a03-e4c6-4b86-9322-43ff1f1f42bc.filesusr.com/ugd/610d21_3b4347a0118a4a07a8b9cfba13a6af45.pdf?index=true
• https://c5fdf1ed-e752-4055-82af-e14222e70f0e.filesusr.com/ugd/89602e_248e696a473f4ee0a6c323cad32826a9.pdf?index=true
• https://2a05e9e6-07fd-4ea1-9c33-bc4c83bfc150.filesusr.com/ugd/3225da_3bd8b32e1cf346e1be09dba7ea37af60.pdf?index=true
• http://vutenu.ilketshallstandrew.com/uploads/1/3/2/8/132814935/897872.pdf
• http://pokude.littlecakepot.com/uploads/1/3/2/6/132681824/fexeja-seviwopis.pdf
• https://19867a25-dc77-425f-97a9-ab14bda4a674.filesusr.com/ugd/9df9d6_d200703251a848a6b97a32655d8de01f.pdf?index=true
• https://62728fd4-0953-4e93-8e9c-d76a20065c9a.filesusr.com/ugd/3ed902_50ca38d5215349f0a695d6307305775c.pdf?index=true
• https://aa311491-8dd5-4fc8-b8ff-88f2dca4898a.filesusr.com/ugd/f08e01_f9983abde7674daa9b5e492e38efd080.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• 058a7a77-6db1-4771-a462-92fd207448d1.filesusr.com
• 0e26175e-70c9-4ea5-9f32-64e9f77fafd5.filesusr.com
• ff18f29a-f807-11ea-a328-fc4dd43d38a6.filesusr.com
• 67fbdadd-ee3e-4001-8f74-41f8f58ae3c4.filesusr.com
• 37cd0a03-e4c6-4b86-9322-43ff1f1f42bc.filesusr.com
• c5fdf1ed-e752-4055-82af-e14222e70f0e.filesusr.com
• 2a05e9e6-07fd-4ea1-9c33-bc4c83bfc150.filesusr.com
• vutenu.ilketshallstandrew.com
• pokude.littlecakepot.com
• 19867a25-dc77-425f-97a9-ab14bda4a674.filesusr.com
• 62728fd4-0953-4e93-8e9c-d76a20065c9a.filesusr.com
• aa311491-8dd5-4fc8-b8ff-88f2dca4898a.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report