MALICIOUS — a2d007_49e7a8442d3849759796f36ac3bdef33.pdf
MALICIOUS — a2d007_49e7a8442d3849759796f36ac3bdef33.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
edec08967948a31d138f04430517218b73b0387fc13d4a2eaca2ac45c9f96c6b - SHA-1:
ae1f619a9e6552c2fc7d6b2abe7caa47033ee884 - MD5:
1f88220ecf1ccc06b1b38afd0d6c4da6 - ssdeep:
768:NgGzpDf5QBTPDYE+DLmgChPYJoF75nM6wiY0lX+sLmZF0UxXlPWu5SY:uGFLSjhPcoF75M6wqX+qmZF0UllPp5SY - TLSH:
T164339FF350ABED8C7A8BEF03ACA6155A6186D78871326B60158C367CD47C6BDBF10520 - Submitted as: a2d007_49e7a8442d3849759796f36ac3bdef33.pdf
- File type: pdf · Size: 48365 bytes
- Verdict: malicious (88/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 88/100 is the fusion of 6 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ttraff.cc/wix?keyword=skeleton+word+equations+answer+key, https://8c1c4707-50f3-45e2-a9bb-7e44abaa55f0.filesusr.com/ugd/0582e0_440f84a80edb40c896652f39cce2694d.pdf?index=true, https://d55ed679-5e60-4588-be20-848e999eda0a.filesusr.com/ugd/e643da_de7d18412da64a81933a6b9219a4572e.pdf?index=true - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.cc/wix?keyword=skeleton+word+equations+answer+key
- https://8c1c4707-50f3-45e2-a9bb-7e44abaa55f0.filesusr.com/ugd/0582e0_440f84a80edb40c896652f39cce2694d.pdf?index=true
- https://d55ed679-5e60-4588-be20-848e999eda0a.filesusr.com/ugd/e643da_de7d18412da64a81933a6b9219a4572e.pdf?index=true
- https://3708007c-d5b4-4769-be1f-3dba6bc5888a.filesusr.com/ugd/6f58fb_18613b2b10d04640bb9806dbfc659707.pdf?index=true
- https://3c415888-bbd5-4b88-b592-771c760fcc6b.filesusr.com/ugd/268ab1_ea176800ef37441db79795c4b9b915e1.pdf?index=true
- https://cdn.shopify.com/s/files/1/0431/3006/0955/files/7017789638.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/pigagijewunafusigiku.pdf
- https://cdn.shopify.com/s/files/1/0438/2582/3904/files/95328528045.pdf
- https://cdn.shopify.com/s/files/1/0484/6089/0273/files/63995196340.pdf
- https://cdn.shopify.com/s/files/1/0435/4280/6679/files/retouching_academy_panel.pdf
- http://lomoz.showuplifestyle.com/uploads/1/3/0/8/130814328/zumekukuzaki.pdf
- http://jagato.hiddengem.net/uploads/1/3/2/6/132681579/pofalavetokel_megibilejike.pdf
- http://zajovaj.valleyautoservice.net/uploads/1/3/1/4/131453041/87c5a.pdf
- http://sapos.andrewbrimhall.com/uploads/1/3/1/3/131398225/0942d9c85091c2.pdf
- http://files.tbulaw.com/uploads/1/3/1/4/131406153/ravujipiba.pdf
- https://97e6ea31-8a2c-4ea2-98e5-a06443364ee1.filesusr.com/ugd/72b0e7_358b5ded65864a9f8fe8788680888ce8.pdf?index=true
- https://d5cbe2b9-3fd8-4c3a-bbf4-d30940a64903.filesusr.com/ugd/89441e_95b59cbf32494c40bab32791c8d794cd.pdf?index=true
- https://dd8ace19-4508-4976-8d5e-657535bf4200.filesusr.com/ugd/5de1df_f5a9713149d9441a8de4e101c4b3bcd7.pdf?index=true
- https://a2df8ee0-2e54-4699-8567-855704c5c7af.filesusr.com/ugd/fb5067_ebe2d1e32d39466290c99f84c1290170.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ttraff.cc
- 8c1c4707-50f3-45e2-a9bb-7e44abaa55f0.filesusr.com
- d55ed679-5e60-4588-be20-848e999eda0a.filesusr.com
- 3708007c-d5b4-4769-be1f-3dba6bc5888a.filesusr.com
- 3c415888-bbd5-4b88-b592-771c760fcc6b.filesusr.com
- cdn.shopify.com
- lomoz.showuplifestyle.com
- jagato.hiddengem.net
- zajovaj.valleyautoservice.net
- sapos.andrewbrimhall.com
- files.tbulaw.com
- 97e6ea31-8a2c-4ea2-98e5-a06443364ee1.filesusr.com
- d5cbe2b9-3fd8-4c3a-bbf4-d30940a64903.filesusr.com
- dd8ace19-4508-4976-8d5e-657535bf4200.filesusr.com
- a2df8ee0-2e54-4699-8567-855704c5c7af.filesusr.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report