MALICIOUS — c83fdb_24babe4e561f470f9104107f3eb68389.pdf

MALICIOUS — c83fdb_24babe4e561f470f9104107f3eb68389.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

SHA-256: 0a50aa92bba666dda3dc0d7afa3c2189bc67627fc2e79c9ec24ef348c7c4ab2f
SHA-1: e87a9b8fd117ba85ca1bd970ce532a20d4cf048f
MD5: 72247e8d90c50957ea388766f5c48dd2
ssdeep: 768:AgGzpDUUx2hmP3igfaVHowb21UVi2d3UKcZ4Tp6CdpN+JUT5I:NGFgjxb0MEKcZmMK+JUT5I
TLSH: T12E32AEF31497EC8D3ACA9B43ADEB1455308AD6C85122F79058D87B6CD47C2BDBE10921
Submitted as: c83fdb_24babe4e561f470f9104107f3eb68389.pdf
File type: pdf · Size: 43817 bytes
Verdict: malicious (88/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.PDF.Agent.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.PDF.Agent.gen (rule HEUR:Trojan.PDF.Agent.gen) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ttraff.cc/wix?keyword=d5+pump+dimensions, https://cdn.shopify.com/s/files/1/0430/4211/1650/files/15343659099.pdf, https://cdn.shopify.com/s/files/1/0439/4093/7896/files/47679785614.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://ttraff.cc/wix?keyword=d5+pump+dimensions
https://cdn.shopify.com/s/files/1/0430/4211/1650/files/15343659099.pdf
https://cdn.shopify.com/s/files/1/0439/4093/7896/files/47679785614.pdf
https://cdn.shopify.com/s/files/1/0438/6009/9222/files/tisivulo.pdf
https://cdn.shopify.com/s/files/1/0430/6996/4439/files/bioscience_reports_portland_press_ltd.pdf
https://cdn.shopify.com/s/files/1/0433/8873/1546/files/58755025323.pdf
https://cdn.shopify.com/s/files/1/0429/6137/1290/files/62733946189.pdf
https://cdn.shopify.com/s/files/1/0437/1123/4197/files/cfa_level_3_curriculum_free.pdf
https://cdn.shopify.com/s/files/1/0432/9334/3899/files/kali_linux_vbox_ova.pdf
http://files.mitacron.com/uploads/1/3/1/6/131636914/2c3d295daa762.pdf
http://dexol.asapsperry.com/uploads/1/3/1/0/131070450/3814278.pdf
http://tijunu.bgbvi.com/uploads/1/3/0/8/130813821/e13c1de4.pdf
http://lutusoz.youngstiling.co.uk/uploads/1/3/1/8/131871745/6128304.pdf
https://4342374a-49ec-4d54-9a39-7650ac195393.filesusr.com/ugd/37987b_ee2c75a40aeb4f888fe5a1c2e4d7a5c5.pdf?index=true
https://e3786523-069a-4075-b623-25038ffda1c4.filesusr.com/ugd/e948c1_8b371dbc290e4c5d95bb104b417b6288.pdf?index=true
https://cb6dea7f-6d99-4d07-aa42-7f7eb2e4e046.filesusr.com/ugd/c1108c_208f070f04a344b89d1d17671c6b3d66.pdf?index=true
https://e61e975e-fdb2-4c78-a538-8cc11874a25b.filesusr.com/ugd/681527_60cd934617664d06bac3e259b58632fe.pdf?index=true
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ttraff.cc
cdn.shopify.com
files.mitacron.com
dexol.asapsperry.com
tijunu.bgbvi.com
lutusoz.youngstiling.co.uk
4342374a-49ec-4d54-9a39-7650ac195393.filesusr.com
e3786523-069a-4075-b623-25038ffda1c4.filesusr.com
cb6dea7f-6d99-4d07-aa42-7f7eb2e4e046.filesusr.com
e61e975e-fdb2-4c78-a538-8cc11874a25b.filesusr.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report