MALICIOUS — e948c1_2cc8c9dc1e4643978881f29b8fc88afc.pdf

MALICIOUS — e948c1_2cc8c9dc1e4643978881f29b8fc88afc.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: fc03faa53d5b97baef365eceff18aa6341d9e667143127588852c49dce2f97d1
• SHA-1: c16bc3061246bfaf7190dcca425dc793be1336a8
• MD5: 6fefe1340a46e2bd3bb6bef27b602fd7
• ssdeep: 768:HgGzpDOZiFslwMFGBI4OV60rzsLm/G4L9a9:AGFi/EBI4YL33L9a9
• TLSH: T1A4309EF7519FDDCC3A8A9B439DAA00581046D2886137EAB098CC776DC4BC2BDBF50960
• Submitted as: e948c1_2cc8c9dc1e4643978881f29b8fc88afc.pdf
• File type: pdf · Size: 36934 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=powerpoint+lesson+2+review+questions+answers, http://tukedu.victoriaho.com/uploads/1/3/2/8/132814930/simigipemafug-zegibako-kuselukok.pdf, http://lowerara.benzandbmwrepair.com/uploads/1/3/1/4/131407197/nawoxukufogup.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=powerpoint+lesson+2+review+questions+answers
• http://tukedu.victoriaho.com/uploads/1/3/2/8/132814930/simigipemafug-zegibako-kuselukok.pdf
• http://lowerara.benzandbmwrepair.com/uploads/1/3/1/4/131407197/nawoxukufogup.pdf
• http://texesujef.souloving.com/uploads/1/3/1/6/131637498/4938828.pdf
• https://cdn.shopify.com/s/files/1/0459/6288/7335/files/19858776510.pdf
• https://cdn.shopify.com/s/files/1/0431/2236/0481/files/65355392280.pdf
• https://cdn.shopify.com/s/files/1/0439/9074/5246/files/afcat_2019_application_form_apply_online.pdf
• https://cdn.shopify.com/s/files/1/0437/6595/6760/files/dragon_s_dogma_online_sorcerer_guide.pdf
• https://a3b9f206-665c-4842-a420-7e61ef58dd4f.filesusr.com/ugd/f08e01_3fe1142bfea842a9b2e035d1c1f4c962.pdf?index=true
• https://1c34a84d-d2c7-4c22-bea6-1a0c9ece6d05.filesusr.com/ugd/0af078_0088396957534b62beaaaf4f415ae176.pdf?index=true
• https://7265a101-a663-4bd2-ac10-7d52bfb80064.filesusr.com/ugd/35c6e2_00e9a7fac260470fac6bb1d0566fac98.pdf?index=true
• https://1f112359-ab5d-41d8-a013-ffffa04f8f8a.filesusr.com/ugd/bc0b97_daf19d3a0525455eb7be474809438a3d.pdf?index=true
• https://ec675336-941a-4909-a858-e8c5d004dad9.filesusr.com/ugd/eb6612_189f02e4c53648caa38571733287d66b.pdf?index=true
• https://68729a23-6527-4023-99ae-725146d65ad6.filesusr.com/ugd/58a813_18a2f20d33a249a2ae6517b197ec4551.pdf?index=true
• https://cc0e86c5-9d95-40fb-8e44-a1f408455a1c.filesusr.com/ugd/a91264_0808ac75392d4668857c2e098bb126ea.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• tukedu.victoriaho.com
• lowerara.benzandbmwrepair.com
• texesujef.souloving.com
• cdn.shopify.com
• a3b9f206-665c-4842-a420-7e61ef58dd4f.filesusr.com
• 1c34a84d-d2c7-4c22-bea6-1a0c9ece6d05.filesusr.com
• 7265a101-a663-4bd2-ac10-7d52bfb80064.filesusr.com
• 1f112359-ab5d-41d8-a013-ffffa04f8f8a.filesusr.com
• ec675336-941a-4909-a858-e8c5d004dad9.filesusr.com
• 68729a23-6527-4023-99ae-725146d65ad6.filesusr.com
• cc0e86c5-9d95-40fb-8e44-a1f408455a1c.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report