MALICIOUS — 11b39a_efedbb0625224c6b9abe3713220a17f7.pdf

MALICIOUS — 11b39a_efedbb0625224c6b9abe3713220a17f7.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: f72cd84469f783561e964cda7e8e3f76bcb2980407b2ec60cec22ddb072a3021
• SHA-1: b5f4eb6409132f42ff28336a31f22c4e13ef7bb4
• MD5: 14b5f584c4ca15e1bd4ab341776e4290
• ssdeep: 768:BgGzpD0S5VBLMt4WOHeuulFYgapILDfaswP6RbZkVXDA8TJdWkVHvSK6uudjFlBn:yGFIkMiWQel7aVTjWkVSbuqvBn
• TLSH: T1D0338DF311ABFC4C7597EF036DDB259DA588E68C602267A458886B3CC1BC67C7E00A50
• Submitted as: 11b39a_efedbb0625224c6b9abe3713220a17f7.pdf
• File type: pdf · Size: 48147 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=unit+7+worksheet+part+1+dna+structure+and+replication, https://cdn.shopify.com/s/files/1/0431/0017/6544/files/bioaccumulation_meaning.pdf, https://cdn.shopify.com/s/files/1/0428/4992/7327/files/jeopardy_tv_show_questions_and_answers.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=unit+7+worksheet+part+1+dna+structure+and+replication
• https://cdn.shopify.com/s/files/1/0431/0017/6544/files/bioaccumulation_meaning.pdf
• https://cdn.shopify.com/s/files/1/0428/4992/7327/files/jeopardy_tv_show_questions_and_answers.pdf
• https://cdn.shopify.com/s/files/1/0432/8810/1030/files/85111110111.pdf
• https://cdn.shopify.com/s/files/1/0434/3591/7464/files/xamenef.pdf
• https://cdn.shopify.com/s/files/1/0428/6126/5062/files/kovutipususufuse.pdf
• https://cdn.shopify.com/s/files/1/0430/4610/9341/files/bolil.pdf
• https://cdn.shopify.com/s/files/1/0429/5147/5363/files/appleseed_alpha_parents_guide.pdf
• https://cdn.shopify.com/s/files/1/0431/0653/3525/files/free_gate_vpn_apk.pdf
• https://cdn.shopify.com/s/files/1/0435/6295/9006/files/58880190391.pdf
• https://cdn.shopify.com/s/files/1/0432/0106/9220/files/12951127097.pdf
• http://tanawivaf.chrismhoward.com/uploads/1/3/0/7/130775050/rapetibupig-pipakoxadi-genixotawowefu-xilogusozesu.pdf
• http://muzuwoz.mondaydesignstudio.com/uploads/1/3/0/7/130775478/tujixitogisureb-mokukozagezos.pdf
• http://files.parksummerprograms.org/uploads/1/3/0/9/130969981/betazerunuguda.pdf
• http://bifar.katastrophique.com/uploads/1/3/1/6/131607095/ditokesikaki-vuguruk-fexipaki.pdf
• https://9197ba9b-053d-4d54-a674-a013f5e2aa43.filesusr.com/ugd/28b3f7_7a61ef13e8f84cc49ebebcb09d1e17f8.pdf?index=true
• https://5cefe2db-0b8c-42d6-9816-21f5dfa0a6f9.filesusr.com/ugd/ee4d88_5e232de338ad474ebdcd381f8e6d6dfd.pdf?index=true
• https://2c351d34-0b5c-48dc-978a-a024783418f9.filesusr.com/ugd/10b11f_dc67d7a04d754a9893314abced9b5dcd.pdf?index=true
• https://9d6bea58-7532-46fe-a2ae-c6531d6b3ca2.filesusr.com/ugd/599026_e468e26a2d6a4b68a3bd60cabfae4012.pdf?index=true
• https://9a5850f9-8d00-431f-b5ac-ae0eca6d0024.filesusr.com/ugd/e4a001_0d65b08edb04417aadfbb21cc913cd43.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/

Embedded domains

• ttraff.club
• cdn.shopify.com
• tanawivaf.chrismhoward.com
• muzuwoz.mondaydesignstudio.com
• files.parksummerprograms.org
• bifar.katastrophique.com
• 9197ba9b-053d-4d54-a674-a013f5e2aa43.filesusr.com
• 5cefe2db-0b8c-42d6-9816-21f5dfa0a6f9.filesusr.com
• 2c351d34-0b5c-48dc-978a-a024783418f9.filesusr.com
• 9d6bea58-7532-46fe-a2ae-c6531d6b3ca2.filesusr.com
• 9a5850f9-8d00-431f-b5ac-ae0eca6d0024.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report