MALICIOUS — 3e7897_1952bd5e10e34aa4892e713c66fc3c1e.pdf

MALICIOUS — 3e7897_1952bd5e10e34aa4892e713c66fc3c1e.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: f2def7fc2d4665b705ad7eb5cde85ccfd2a9556f5f8b71433dafa715316ceee3
• SHA-1: eb9f5c68240899f04ebc46f67da0b8919bcf3e26
• MD5: 27569c2794070edb2608afd6b88d6d16
• ssdeep: 768:HgGzpDf+8l0H97vSJ8lGXt2atxbfZ3HfS51ByS1Nc0REl6OzrgRXjGN6:AGFDXo+JtxT5qbByiNc0M6OQXjGN6
• TLSH: T1A831AEF3545BEC8C7A86AB039DEA05552589C649A133E7A06888777CC1FC9BD7F21820
• Submitted as: 3e7897_1952bd5e10e34aa4892e713c66fc3c1e.pdf
• File type: pdf · Size: 42110 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=color+white+worksheets, https://cdn.shopify.com/s/files/1/0432/9455/6320/files/jexomegalo.pdf, https://cdn.shopify.com/s/files/1/0431/0695/9514/files/wimoxirol.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=color+white+worksheets
• https://cdn.shopify.com/s/files/1/0432/9455/6320/files/jexomegalo.pdf
• https://cdn.shopify.com/s/files/1/0431/0695/9514/files/wimoxirol.pdf
• https://cdn.shopify.com/s/files/1/0434/0659/0104/files/77531684213.pdf
• http://bobit.wishingstarrescuefoundation.com/uploads/1/3/1/3/131382470/4530900.pdf
• http://files.allforonefoundation.org/uploads/1/3/1/3/131380728/2519333.pdf
• http://wowizuj.womeninbusinessisu.com/uploads/1/3/0/9/130969478/cdbf2.pdf
• http://files.browardcountyacf.com/uploads/1/3/1/3/131398134/6138813.pdf
• http://poxew.cornerstonepagans.org/uploads/1/3/1/6/131636725/bf4cbc6fbd95a.pdf
• http://polekov.somersetrehab.com/uploads/1/3/0/8/130874038/gadomovenujabep-mujid.pdf
• http://jerebofiw.bcproducebc.ca/uploads/1/3/0/9/130969204/zigaduwezuriduz.pdf
• http://fanuvasup.gordonpicken.com/uploads/1/3/1/3/131381464/3141983.pdf
• https://cdn.shopify.com/s/files/1/0461/6129/7560/files/jopubeweloku.pdf
• https://cdn.shopify.com/s/files/1/0486/3226/6920/files/66545684057.pdf
• https://cdn.shopify.com/s/files/1/0459/2471/2615/files/gateway_c1_workbook_answer_key.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• cdn.shopify.com
• bobit.wishingstarrescuefoundation.com
• files.allforonefoundation.org
• wowizuj.womeninbusinessisu.com
• files.browardcountyacf.com
• poxew.cornerstonepagans.org
• polekov.somersetrehab.com
• jerebofiw.bcproducebc.ca
• fanuvasup.gordonpicken.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report