MALICIOUS — 7198c1_a5bd5c653a9e478eaecb6841e63cbd11.pdf

MALICIOUS — 7198c1_a5bd5c653a9e478eaecb6841e63cbd11.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: eb2850ba9d7ce262d329ff979ca033c58234e51d873afb120fa5dd4bb063e28d
• SHA-1: 408b713fc1601505f2b2179ce0c0888fa6710894
• MD5: 519fe505a788ef97252af335ea36dd6e
• ssdeep: 768:lgGzpDUIRGbnXwayElpbjplCp4KN7Ki12kuA1Ez1NIaAJDyGXON/VP:2GF4yspbjpYpBUiokJm1NBANyGXON/VP
• TLSH: T1E132AFF75097ED8C6A879F93B8EA018CF44696846033A3A414DC7B6CC5787EE1F20921
• Submitted as: 7198c1_a5bd5c653a9e478eaecb6841e63cbd11.pdf
• File type: pdf · Size: 46045 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=red+tape+rte+1671, https://c7f123ba-3b69-4159-be4d-867a12409d76.filesusr.com/ugd/fe83c3_876b7bffb61f4830bc120f6643082bf9.pdf?index=true, https://c6d6e2a8-d382-4782-80d2-5fac6f8d9af0.filesusr.com/ugd/8acad3_69e22543770440c4b8115841ad330b03.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=red+tape+rte+1671
• https://c7f123ba-3b69-4159-be4d-867a12409d76.filesusr.com/ugd/fe83c3_876b7bffb61f4830bc120f6643082bf9.pdf?index=true
• https://c6d6e2a8-d382-4782-80d2-5fac6f8d9af0.filesusr.com/ugd/8acad3_69e22543770440c4b8115841ad330b03.pdf?index=true
• https://935cfdc9-16b6-47a1-8dca-7b1701907246.filesusr.com/ugd/370ea2_e4686b54dd6b4adeb075cd82edde2cee.pdf?index=true
• https://35914475-199d-4c94-a0d7-53af481151f2.filesusr.com/ugd/694d5d_8000871d5938415088dc4439b8d57306.pdf?index=true
• http://files.thorntonmetals.com/uploads/1/3/1/8/131856039/muwodutaxetal-kutepujovo-xepedagonavu-lenawefozujus.pdf
• http://vazavew.lauralrees.com/uploads/1/3/1/4/131436977/9259325.pdf
• http://junuj.thetrophywifestyle.com/uploads/1/3/1/4/131437607/eb09be9046.pdf
• https://6e7e776b-753c-4b3a-a84d-4086bf3fbb55.filesusr.com/ugd/d99ef3_3297ab2e7c0e4a3f951e6e4ce58fb5f0.pdf?index=true
• https://a86a66e0-de0f-46b7-87a0-1e227422e571.filesusr.com/ugd/895bef_72493e1ca2fb45bc896dbecedca6f67d.pdf?index=true
• https://43fc62cf-ff9d-4f95-9302-50eb9edf88dc.filesusr.com/ugd/d2cc1f_da5074b57bb6443dbc595c59dea54f7f.pdf?index=true
• https://cdn.shopify.com/s/files/1/0437/2335/8358/files/63552804111.pdf
• https://cdn.shopify.com/s/files/1/0433/6710/4668/files/82666840612.pdf
• https://cdn.shopify.com/s/files/1/0431/0191/3244/files/24392524498.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• c7f123ba-3b69-4159-be4d-867a12409d76.filesusr.com
• c6d6e2a8-d382-4782-80d2-5fac6f8d9af0.filesusr.com
• 935cfdc9-16b6-47a1-8dca-7b1701907246.filesusr.com
• 35914475-199d-4c94-a0d7-53af481151f2.filesusr.com
• files.thorntonmetals.com
• vazavew.lauralrees.com
• junuj.thetrophywifestyle.com
• 6e7e776b-753c-4b3a-a84d-4086bf3fbb55.filesusr.com
• a86a66e0-de0f-46b7-87a0-1e227422e571.filesusr.com
• 43fc62cf-ff9d-4f95-9302-50eb9edf88dc.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report