MALICIOUS — 4ca7f5_1ae7cb1921164da5bc8baea9e7801d01.pdf

MALICIOUS — 4ca7f5_1ae7cb1921164da5bc8baea9e7801d01.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: ff04f7ba40fd3335d35cc3793efd97482326a3b2c8cb3cea4d6514c17c8ceacf
• SHA-1: 067b9aa7cc544f147ee5301413f02f0beb831ed3
• MD5: 1169fef41e1b3391922ef69f34ce6829
• ssdeep: 768:+gGzpD3JSbB3D8D87ATqLGgrpp0FWftbgt9G76frRxXlPWlANZ:7GFbJSXBGgrU+bg6761llP2ANZ
• TLSH: T1B7329EF3509BEDCD6A87AF43A8B605596045C68D7136AB6008D8776CC4BC1BCAF11A21
• Submitted as: 4ca7f5_1ae7cb1921164da5bc8baea9e7801d01.pdf
• File type: pdf · Size: 46517 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=gimnasia+ritmica+olimpiadas, https://db830595-63e8-4ee1-b919-cc8fbd902758.filesusr.com/ugd/1e533a_44f74d21bc034f758da164f224a6f57c.pdf?index=true, https://ccb5a1c1-d4f3-4b4e-b1b9-e6205b3819f7.filesusr.com/ugd/625844_5b4576f0b894496a8e5438d2dee0a6bb.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=gimnasia+ritmica+olimpiadas
• https://db830595-63e8-4ee1-b919-cc8fbd902758.filesusr.com/ugd/1e533a_44f74d21bc034f758da164f224a6f57c.pdf?index=true
• https://ccb5a1c1-d4f3-4b4e-b1b9-e6205b3819f7.filesusr.com/ugd/625844_5b4576f0b894496a8e5438d2dee0a6bb.pdf?index=true
• https://0f868836-cbc4-47c3-b856-d11ba4755e57.filesusr.com/ugd/6cf0f5_e8ed30e682924296946c973452abfa6c.pdf?index=true
• https://e86b6575-d06f-4a1b-ab66-affb24164b66.filesusr.com/ugd/575363_921db6ee6df04f84ad5be40df14e9372.pdf?index=true
• https://12b55e6d-44db-4c61-95b9-7058120c2a3d.filesusr.com/ugd/3f8d85_299bd4578d14499bb4fcf2d43d347224.pdf?index=true
• https://05c6b21a-1693-4e05-8255-5b0c66278c0f.filesusr.com/ugd/81cd61_4af4a50194044add9ac6f7e74f416300.pdf?index=true
• http://files.mairibudreau.com/uploads/1/3/0/7/130776864/ziwawajobigogefivane.pdf
• http://redidewu.kidsonuptherapy.com/uploads/1/3/2/6/132681946/gazuselizagan.pdf
• https://cdn.shopify.com/s/files/1/0438/7163/3563/files/gezodalibotaxikixivel.pdf
• https://cdn.shopify.com/s/files/1/0431/0378/1015/files/63919955400.pdf
• https://cdn.shopify.com/s/files/1/0433/8787/9587/files/dividing_polynomials_math-_aids._com_answers.pdf
• https://cdn.shopify.com/s/files/1/0437/9007/4018/files/audacity_auto_tune.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• db830595-63e8-4ee1-b919-cc8fbd902758.filesusr.com
• ccb5a1c1-d4f3-4b4e-b1b9-e6205b3819f7.filesusr.com
• 0f868836-cbc4-47c3-b856-d11ba4755e57.filesusr.com
• e86b6575-d06f-4a1b-ab66-affb24164b66.filesusr.com
• 12b55e6d-44db-4c61-95b9-7058120c2a3d.filesusr.com
• 05c6b21a-1693-4e05-8255-5b0c66278c0f.filesusr.com
• files.mairibudreau.com
• redidewu.kidsonuptherapy.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report