MALICIOUS — 04e6f9_91feccde1339409091a1e1fa3fc0eb07.pdf
MALICIOUS — 04e6f9_91feccde1339409091a1e1fa3fc0eb07.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
e9d9c730c504879b084f07aaac41c073f4523c7335b8fe5b039bc363d54ed9d3 - SHA-1:
925548811dbd02eb401c7477860a530a7c7e14fe - MD5:
bf0eb8e8243b7d496a6dc54222954f93 - ssdeep:
768:+gGzpDeRiO2bfFUIfH+EKD82aAYLgc0aDAOs450:7GFSQyqAeg1hOs450 - TLSH:
T11C309EF35097EC4C3A876B07EDA6116AA189C78D6226E77054DC3B2CC4BC2BDAE50570 - Submitted as: 04e6f9_91feccde1339409091a1e1fa3fc0eb07.pdf
- File type: pdf · Size: 38497 bytes
- Verdict: malicious (95/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.PDF.Agent.gen
MITRE ATT&CK
Why this verdict
The malicious score of 95/100 is the fusion of 7 weighted signals:
- Embedded link rated malicious by URL analysis: https://9dcf42da-17d1-4ae7-9fcd-0e0941380461.filesusr.com/ugd/eb6612_50225242ff1744a1b2dc78c2556e3af3.pdf?index=true - network signal, weight 0.70, confidence 0.80
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.PDF.Agent.gen (rule
HEUR:Trojan.PDF.Agent.gen) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ttraff.cc/wix?keyword=case+for+christ+study+guide+pdf, https://36459dcd-c992-4acc-8ba1-679321e87a87.filesusr.com/ugd/f1780b_86cafb427a8a407baedec6d18a22a64d.pdf?index=true, https://70da7817-77f8-4cd3-89bb-a5383a9161a8.filesusr.com/ugd/0789d5_28f28b68631b4269a06ae73c172592d2.pdf?index=true - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.cc/wix?keyword=case+for+christ+study+guide+pdf
- https://36459dcd-c992-4acc-8ba1-679321e87a87.filesusr.com/ugd/f1780b_86cafb427a8a407baedec6d18a22a64d.pdf?index=true
- https://70da7817-77f8-4cd3-89bb-a5383a9161a8.filesusr.com/ugd/0789d5_28f28b68631b4269a06ae73c172592d2.pdf?index=true
- https://36bfb764-3179-4080-bd8d-75bb60bcf256.filesusr.com/ugd/0582e0_03293a65deb24ccf8ea21bd87e55b4b1.pdf?index=true
- https://cdn.shopify.com/s/files/1/0433/0097/8853/files/pefaxujoxogejo.pdf
- https://cdn.shopify.com/s/files/1/0429/3669/6999/files/banureg.pdf
- https://cdn.shopify.com/s/files/1/0429/5114/7679/files/belajar_membaca_free_download.pdf
- https://cdn.shopify.com/s/files/1/0430/8982/1845/files/27129415309.pdf
- https://cdn.shopify.com/s/files/1/0432/9691/5621/files/storytown_grammar_practice_book_grade_3.pdf
- http://files.bethcarina.com/uploads/1/3/0/8/130814411/323d5c28b827.pdf
- http://files.independentlutherandiocese.com/uploads/1/3/0/9/130969656/rosokojepuzefo-lasuguzekibegut.pdf
- http://tozisofe.inromatours.com/uploads/1/3/2/7/132740414/4158507.pdf
- http://files.betapichaptertx.com/uploads/1/3/1/3/131378780/tesok.pdf
- http://rozixuma.barbaraearly.com/uploads/1/3/2/6/132695375/furidegegijezitanez.pdf
- https://9dcf42da-17d1-4ae7-9fcd-0e0941380461.filesusr.com/ugd/eb6612_50225242ff1744a1b2dc78c2556e3af3.pdf?index=true
- https://5b7f1b2d-36a9-49b5-b4d1-22f79872540d.filesusr.com/ugd/95ea6b_a11c37fa19334d219787a303bb5bcdc4.pdf?index=true
- https://62fc76b2-7e71-44b1-a3e1-64683245cf0b.filesusr.com/ugd/d5415a_a6b20974b64f481abd5e9d32cb915138.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ttraff.cc
- 36459dcd-c992-4acc-8ba1-679321e87a87.filesusr.com
- 70da7817-77f8-4cd3-89bb-a5383a9161a8.filesusr.com
- 36bfb764-3179-4080-bd8d-75bb60bcf256.filesusr.com
- cdn.shopify.com
- files.bethcarina.com
- files.independentlutherandiocese.com
- tozisofe.inromatours.com
- files.betapichaptertx.com
- rozixuma.barbaraearly.com
- 9dcf42da-17d1-4ae7-9fcd-0e0941380461.filesusr.com
- 5b7f1b2d-36a9-49b5-b4d1-22f79872540d.filesusr.com
- 62fc76b2-7e71-44b1-a3e1-64683245cf0b.filesusr.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report