MALICIOUS — d4da64_31742d6c683943e2988738bc7dfff107.pdf

MALICIOUS — d4da64_31742d6c683943e2988738bc7dfff107.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: fd41c58e034711df56c172cbd76d707fae5efdacdec71ef094315949be8029a1
SHA-1: 4de5e75e7073267c651518b2de151ea15fe06353
MD5: e18da3c939fab4e5ffef64aa9941521a
ssdeep: 1536:zGFK++g41ub1mJYfv0ROkt5lIys/A65PO5kRqcZ2G:CFK+f4181mKvL05sBOmRqc1
TLSH: T1EC35DFF36117EE88AD87BB435DBA1148D04ADA8D32329A6444C87BBCD87C1BD7F91910
Submitted as: d4da64_31742d6c683943e2988738bc7dfff107.pdf
File type: pdf · Size: 63218 bytes
Verdict: malicious (88/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ttraff.com/wix?keyword=timex+ironman+triathlon+shock+manual, http://jopevip.wolfpackbands.org/uploads/1/3/0/8/130813821/4829212.pdf, http://lomijoxo.greenbaywalleyeseries.com/uploads/1/3/1/6/131636698/4051870.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

1079 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://ttraff.com/wix?keyword=timex+ironman+triathlon+shock+manual
http://jopevip.wolfpackbands.org/uploads/1/3/0/8/130813821/4829212.pdf
http://lomijoxo.greenbaywalleyeseries.com/uploads/1/3/1/6/131636698/4051870.pdf
http://files.terriemckee.net/uploads/1/3/2/8/132815854/rukibej.pdf
http://nufiguju.greenkeyconcreteforms.com/uploads/1/3/1/4/131453870/peravi.pdf
https://cdn.shopify.com/s/files/1/0430/8526/7097/files/edgar_allan_poe_s_the_raven_worksheet.pdf
https://633eb71f-9f89-41a7-975a-816f0b93ca03.filesusr.com/ugd/24deb6_1e0644bec0094462b69b5c86266c0944.pdf?index=true
https://a6911fc2-c93e-4f4b-8ae0-00468fc1261e.filesusr.com/ugd/c722c2_feac4e98325b40b389adceeec8fb6f7e.pdf?index=true
https://c9714f1b-0675-4f6b-ac94-3c2edd4781c6.filesusr.com/ugd/314c35_2b960a1593ca4e7b96c1cd73ce57f44c.pdf?index=true
https://27a023a7-4550-4e2a-b886-4a8b2ffabe23.filesusr.com/ugd/bba345_e034081784e1497a9f227de2fa92cf41.pdf?index=true
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ttraff.com
jopevip.wolfpackbands.org
lomijoxo.greenbaywalleyeseries.com
files.terriemckee.net
nufiguju.greenkeyconcreteforms.com
cdn.shopify.com
633eb71f-9f89-41a7-975a-816f0b93ca03.filesusr.com
a6911fc2-c93e-4f4b-8ae0-00468fc1261e.filesusr.com
c9714f1b-0675-4f6b-ac94-3c2edd4781c6.filesusr.com
27a023a7-4550-4e2a-b886-4a8b2ffabe23.filesusr.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report