MALICIOUS — 18574e_ba8c2d9417974b55ae944fb46600fdb2.pdf

MALICIOUS — 18574e_ba8c2d9417974b55ae944fb46600fdb2.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: fd9b97c860a7ea3a6648e700bd69bf3d8d498285d47cf7175d6f93a50783faf8
• SHA-1: 8893daf40607f55a8d4d18adbc46e5d004035e0d
• MD5: 78460ee940951e61bbb6aae2459b958c
• ssdeep: 768:pgGzpDLNWWweLr58jSsAZ67Md/sZbPiKE6aBwUrq:KGF/b+jSNsbPRaBwUrq
• TLSH: T189318DF3508BEE8D2ACA9F07ADE61159A145C28D323297704488777CD47CAFDAE10961
• Submitted as: 18574e_ba8c2d9417974b55ae944fb46600fdb2.pdf
• File type: pdf · Size: 42041 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=assessment+in+inclusive+education+pdf, https://cdn.shopify.com/s/files/1/0428/3524/7271/files/zikevikewuzonojiwe.pdf, https://cdn.shopify.com/s/files/1/0430/4571/6129/files/65946954164.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=assessment+in+inclusive+education+pdf
• https://cdn.shopify.com/s/files/1/0428/3524/7271/files/zikevikewuzonojiwe.pdf
• https://cdn.shopify.com/s/files/1/0430/4571/6129/files/65946954164.pdf
• https://cdn.shopify.com/s/files/1/0437/3518/7605/files/chatrapathi_video_songs_tinyjuke.pdf
• https://cdn.shopify.com/s/files/1/0430/9801/3863/files/14716549593.pdf
• https://cdn.shopify.com/s/files/1/0480/7874/9860/files/96340432665.pdf
• https://58a844be-f511-4719-bf8f-1efa9540ff04.filesusr.com/ugd/26f730_cb04392808fb43b5857302103bf9716a.pdf?index=true
• https://31b6ff91-bdfa-44e5-b52b-bab8a22795f0.filesusr.com/ugd/d38238_0e30897120124237b081ed4dc2b08ed1.pdf?index=true
• http://libij.hikingtheappalachians.com/uploads/1/3/0/7/130776257/wijibajebu_sipanifixiwega_mofizuwoluz_jozepizamotor.pdf
• http://fividi.groundedplantandfloral.com/uploads/1/3/1/4/131407181/5660365.pdf
• http://files.miguelemoovie.com/uploads/1/3/2/7/132712057/3fa7605.pdf
• http://files.granbyag.org/uploads/1/3/0/7/130739239/fajakamekafuk.pdf
• http://files.dandmtowing.co.uk/uploads/1/3/0/7/130740521/0b2c4.pdf
• https://da37753b-3f70-4ac5-8658-df1f728bede4.filesusr.com/ugd/ca32a8_d722b2d7db3e44fc91e2e1b76aed099f.pdf?index=true
• https://0fffb673-8a32-4f47-96ad-9225d8414b7d.filesusr.com/ugd/44b221_6bc09035863f45bbb63047058fad88f6.pdf?index=true
• https://da1b6f5d-d71a-4b99-b3b1-f3372cbab093.filesusr.com/ugd/1b6cec_7afe63b41ab943609a7824a3e7e72cea.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• cdn.shopify.com
• 58a844be-f511-4719-bf8f-1efa9540ff04.filesusr.com
• 31b6ff91-bdfa-44e5-b52b-bab8a22795f0.filesusr.com
• libij.hikingtheappalachians.com
• fividi.groundedplantandfloral.com
• files.miguelemoovie.com
• files.granbyag.org
• files.dandmtowing.co.uk
• da37753b-3f70-4ac5-8658-df1f728bede4.filesusr.com
• 0fffb673-8a32-4f47-96ad-9225d8414b7d.filesusr.com
• da1b6f5d-d71a-4b99-b3b1-f3372cbab093.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report