MALICIOUS — 7cefa9_e44835294f5f438da751750c1dba7f76.pdf

MALICIOUS — 7cefa9_e44835294f5f438da751750c1dba7f76.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: f1cd723d6ba6edd45998fcaa7ea677527cf825222614fe0d086f17b995053139
• SHA-1: d5aa6055ed2606c579f7219a1c663c401427950b
• MD5: d0ff935f66784ac0661b1cc0186e27e9
• ssdeep: 768:ngGzpDCNntvkNMr0CHOIvnf8H77RVpyWMSUaqeQKi9I3HCKipRK:gGFesN/Iff8blOJeQKiCXipRK
• TLSH: T17734AEF31067EE8C3A9F6F479ED621A8A485E28D513796B048C4766DC07C3FD2E20925
• Submitted as: 7cefa9_e44835294f5f438da751750c1dba7f76.pdf
• File type: pdf · Size: 52456 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=overview+clues+to+earth%2527s+past+answer+key, http://files.choestoebaptistchurch.org/uploads/1/3/1/6/131607163/mofojajoku.pdf, http://files.bedbugsremoval.com.au/uploads/1/3/2/3/132302926/favuraxoduzut.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=overview+clues+to+earth%2527s+past+answer+key
• http://files.choestoebaptistchurch.org/uploads/1/3/1/6/131607163/mofojajoku.pdf
• http://files.bedbugsremoval.com.au/uploads/1/3/2/3/132302926/favuraxoduzut.pdf
• http://rarujinaf.objectpages.com/uploads/1/3/1/4/131453872/jogadug_falerun_visimuleve_fibawesazu.pdf
• http://mefozaneb.litturi-photography.com/uploads/1/3/2/7/132710567/rijusiwub.pdf
• http://files.knightsautowash.com/uploads/1/3/0/7/130776386/8500239.pdf
• https://cdn.shopify.com/s/files/1/0431/7600/1704/files/34440505086.pdf
• https://cdn.shopify.com/s/files/1/0434/8814/9654/files/javarukaxalaveku.pdf
• https://f092bec7-e105-4e44-bf20-fd1eeb3e23a5.filesusr.com/ugd/3ed902_2a3d1838a4b74895b3e579fa5df878be.pdf?index=true
• https://4ae5a20e-6764-4ec4-8b01-9c7529a94cc3.filesusr.com/ugd/80bfa9_4245df53cec44fad86b53369f6b08c02.pdf?index=true
• https://b5b3e5c8-5807-4c85-8f27-8b7d0e237dac.filesusr.com/ugd/0b46e6_fad31ae4cc0142ae94257b70600cef2c.pdf?index=true
• https://4a81779e-23ba-4f1c-a811-b8f781134158.filesusr.com/ugd/48bf55_020351a9c4534ce28007d6160f1757ac.pdf?index=true
• https://d2d7aba7-83de-475f-93cc-e9bdccb07b1c.filesusr.com/ugd/0b46e6_3050af66f4c549eb94a2d7c847e203c3.pdf?index=true
• https://d33ba8b3-a666-4303-9248-0610a85f1f8e.filesusr.com/ugd/2994dd_d1cc7326e39349f4938ea291edcefcf0.pdf?index=true
• https://c8fbccee-eb0d-48f7-8803-1b3fd3406348.filesusr.com/ugd/565485_5c3bc1dd35e04de8a109a1218113982e.pdf?index=true
• https://bd9b38d7-755e-4204-9950-d5a349025850.filesusr.com/ugd/b90ba1_659f2b9359ab4388bd4ab538be37f80c.pdf?index=true
• https://dd894573-7770-4b88-9555-d0d04f311cde.filesusr.com/ugd/430cb2_e449efa94ff84538be7efa76e6801277.pdf?index=true
• https://19867a25-dc77-425f-97a9-ab14bda4a674.filesusr.com/ugd/9df9d6_d200703251a848a6b97a32655d8de01f.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• files.choestoebaptistchurch.org
• files.bedbugsremoval.com.au
• rarujinaf.objectpages.com
• mefozaneb.litturi-photography.com
• files.knightsautowash.com
• cdn.shopify.com
• f092bec7-e105-4e44-bf20-fd1eeb3e23a5.filesusr.com
• 4ae5a20e-6764-4ec4-8b01-9c7529a94cc3.filesusr.com
• b5b3e5c8-5807-4c85-8f27-8b7d0e237dac.filesusr.com
• 4a81779e-23ba-4f1c-a811-b8f781134158.filesusr.com
• d2d7aba7-83de-475f-93cc-e9bdccb07b1c.filesusr.com
• d33ba8b3-a666-4303-9248-0610a85f1f8e.filesusr.com
• c8fbccee-eb0d-48f7-8803-1b3fd3406348.filesusr.com
• bd9b38d7-755e-4204-9950-d5a349025850.filesusr.com
• dd894573-7770-4b88-9555-d0d04f311cde.filesusr.com
• 19867a25-dc77-425f-97a9-ab14bda4a674.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report