MALICIOUS — c5d40f_234f1071dc364e1f9e9d6cc519be71bc.pdf

MALICIOUS — c5d40f_234f1071dc364e1f9e9d6cc519be71bc.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: f81d865827f6b97c75f8e8a81a40d881f5a63c06ad6975439a97b69746daa1d2
• SHA-1: 8f256780a9c6ce7cfbfeafe81671d4a80ee4fd04
• MD5: 4c5b48732290f05d5bff17a9b578283c
• ssdeep: 1536:qGF0kmJoqlmwKyioVFLjDD4/VvBO+BlpQ1Xrc:TF0k0lJZioVVM/OmlpQ1A
• TLSH: T18B36CFF3A0B3CD8D379B9B43DA9A14691186D74C6033A7510589BB3CD8B83FC6E41261
• Submitted as: c5d40f_234f1071dc364e1f9e9d6cc519be71bc.pdf
• File type: pdf · Size: 66696 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=wholesale+product+purchase+agreement, http://files.outdoorfitnesssligo.com/uploads/1/3/0/8/130874678/a4a84b9890e37fd.pdf, http://tusoxonut.tchindesigns.com/uploads/1/3/0/7/130775376/6182892.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=wholesale+product+purchase+agreement
• http://files.outdoorfitnesssligo.com/uploads/1/3/0/8/130874678/a4a84b9890e37fd.pdf
• http://tusoxonut.tchindesigns.com/uploads/1/3/0/7/130775376/6182892.pdf
• http://files.barefoothoofs.com/uploads/1/3/1/6/131637640/6817131.pdf
• http://legolifi.experienceyourdream.net/uploads/1/3/0/7/130739206/9418204.pdf
• https://ea7de183-9a05-4864-ae89-de304a36075d.filesusr.com/ugd/764aaa_9cdb07133281432bb15a4585e225cc4f.pdf?index=true
• https://339ca535-dce5-4960-bbca-88438a73bcb9.filesusr.com/ugd/594ae5_b69b9a8b595a45d3a7ce3bfde504601d.pdf?index=true
• https://85093e06-c5e4-4b1f-a775-075cea669c23.filesusr.com/ugd/83b1b3_1bdadf298fc846e3b93de70997c61466.pdf?index=true
• https://35a0a1b7-cad7-487f-b933-3681ebebef64.filesusr.com/ugd/6cfc61_81201539bc964bf7a1fdcdd3e4b753fb.pdf?index=true
• https://cdn.shopify.com/s/files/1/0432/3616/3747/files/download_scph1001.bin_for_epsxe_android.pdf
• https://cdn.shopify.com/s/files/1/0432/4638/7362/files/zovotuwiwesaxokota.pdf
• https://cdn.shopify.com/s/files/1/0430/5115/5618/files/tudekisodimewan.pdf
• https://cdn.shopify.com/s/files/1/0429/5426/0633/files/use_animated_gif_in.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• files.outdoorfitnesssligo.com
• tusoxonut.tchindesigns.com
• files.barefoothoofs.com
• legolifi.experienceyourdream.net
• ea7de183-9a05-4864-ae89-de304a36075d.filesusr.com
• 339ca535-dce5-4960-bbca-88438a73bcb9.filesusr.com
• 85093e06-c5e4-4b1f-a775-075cea669c23.filesusr.com
• 35a0a1b7-cad7-487f-b933-3681ebebef64.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report