MALICIOUS — 1e557c_b977bb170dbd4fe081e87813492407b3.pdf

MALICIOUS — 1e557c_b977bb170dbd4fe081e87813492407b3.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 1a15e299abc0748560919289907e314192ee763d2b0f192ed383cd3f952318b3
• SHA-1: 1aa8117a60de224920e30c5018788c7d65bf9ed4
• MD5: 45e3262b9cfa93d1bb4b78979575d369
• ssdeep: 768:OgGzpD+sv7K2OnbGBrG5Ao4pGhJ1NWv2QFPAdSm66XUeE95bUoWu4qvzvJ:rGFioLOn8oM0UOQCzUF9VWu4qvzvJ
• TLSH: T1AD328DF314E7EE8C669A9B07ADAB21156085D38D3177A32045CCB77DC4BC2ADAE50930
• Submitted as: 1e557c_b977bb170dbd4fe081e87813492407b3.pdf
• File type: pdf · Size: 43430 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.PDF.Agent.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.PDF.Agent.gen (rule HEUR:Trojan.PDF.Agent.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=avakin+life+hack+without+human+verification, https://70c59834-733b-430b-a8ef-7ac1fa6bff43.filesusr.com/ugd/b56239_e0e154d8f7994e8e94d37cc93a42e453.pdf?index=true, https://7bbea11f-e94c-483d-8200-e6fdaefdcfcb.filesusr.com/ugd/d90490_c98ef058f0304fc0b3b3bcb07e9f569d.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=avakin+life+hack+without+human+verification
• https://70c59834-733b-430b-a8ef-7ac1fa6bff43.filesusr.com/ugd/b56239_e0e154d8f7994e8e94d37cc93a42e453.pdf?index=true
• https://7bbea11f-e94c-483d-8200-e6fdaefdcfcb.filesusr.com/ugd/d90490_c98ef058f0304fc0b3b3bcb07e9f569d.pdf?index=true
• https://b1e23648-5a69-4489-8d0d-dc3bb45cdf85.filesusr.com/ugd/43d598_79bcbf178d5e48068cde2952beea13e6.pdf?index=true
• https://56ee5e49-eded-40c0-8c84-2ac9f73f1c16.filesusr.com/ugd/dad7b5_58c1694e839c40c9bae08dd03582f9dd.pdf?index=true
• https://d9bff7a2-9908-42eb-8809-4509abcf0ba2.filesusr.com/ugd/1e52da_c3fa4aebffcd45008eb779821e995af7.pdf?index=true
• https://fe0d402d-7bc3-451c-ae3c-c74275463eb2.filesusr.com/ugd/f1780b_12ee45c739f24d50b2174a86e234c393.pdf?index=true
• https://505c6495-45f7-4e1e-b7de-106bc4633269.filesusr.com/ugd/314c35_49deb009db894a81934875863b8bd130.pdf?index=true
• https://be06afbe-0410-4831-bff1-d1b476a7d5e5.filesusr.com/ugd/594ae5_3b2ba62fc9e94b7e8710475e46d75ca8.pdf?index=true
• https://178351b1-e344-4555-b45d-5f3c55547557.filesusr.com/ugd/26481d_87562ebc44014e4dae5e8603a58b24c5.pdf?index=true
• https://068a687f-7d59-4991-92a1-cbc4f92548d4.filesusr.com/ugd/e3c460_4ee36dc8d89346619fcd1ea6bb34a26b.pdf?index=true
• https://0619cd6b-d8cc-4697-8efe-136581b3d48a.filesusr.com/ugd/0286dd_f9d1d857437e4c01b3ba5535e31479fe.pdf?index=true
• https://ffdaf45e-0183-44ce-b4b9-b0707bb5c42f.filesusr.com/ugd/668a47_ad5059f6a5f04067988ac9bcb4e6f35a.pdf?index=true
• https://e3786523-069a-4075-b623-25038ffda1c4.filesusr.com/ugd/e948c1_8b371dbc290e4c5d95bb104b417b6288.pdf?index=true
• https://d782772a-88ee-44a3-8935-ff773e862675.filesusr.com/ugd/ed8107_9c783dc6737244e5915c2927b2de466f.pdf?index=true
• https://b3b20f2a-2a73-471b-b995-1d0624423f43.filesusr.com/ugd/162fe6_3c6a092f3e28478e961152cbaca3038f.pdf?index=true
• https://27bae055-ef63-4482-aefc-bb60b2ff0acc.filesusr.com/ugd/154db6_566cc125a5b742c7a9fe5dda45456eef.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• 70c59834-733b-430b-a8ef-7ac1fa6bff43.filesusr.com
• 7bbea11f-e94c-483d-8200-e6fdaefdcfcb.filesusr.com
• b1e23648-5a69-4489-8d0d-dc3bb45cdf85.filesusr.com
• 56ee5e49-eded-40c0-8c84-2ac9f73f1c16.filesusr.com
• d9bff7a2-9908-42eb-8809-4509abcf0ba2.filesusr.com
• fe0d402d-7bc3-451c-ae3c-c74275463eb2.filesusr.com
• 505c6495-45f7-4e1e-b7de-106bc4633269.filesusr.com
• be06afbe-0410-4831-bff1-d1b476a7d5e5.filesusr.com
• 178351b1-e344-4555-b45d-5f3c55547557.filesusr.com
• 068a687f-7d59-4991-92a1-cbc4f92548d4.filesusr.com
• 0619cd6b-d8cc-4697-8efe-136581b3d48a.filesusr.com
• ffdaf45e-0183-44ce-b4b9-b0707bb5c42f.filesusr.com
• e3786523-069a-4075-b623-25038ffda1c4.filesusr.com
• d782772a-88ee-44a3-8935-ff773e862675.filesusr.com
• b3b20f2a-2a73-471b-b995-1d0624423f43.filesusr.com
• 27bae055-ef63-4482-aefc-bb60b2ff0acc.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report