MALICIOUS — fe83c3_62d145eeebe9418cbfad72138899338b.pdf

MALICIOUS — fe83c3_62d145eeebe9418cbfad72138899338b.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 1c9442d0a58dca398a024f7142eb7e5f4445752c5ea7a83ab19dae5fd4949ed2
• SHA-1: 0e02ec2e6980671d18b4be57b295987eaf9d70ea
• MD5: f22a9f028ecff4477403f53b54a168cf
• ssdeep: 768:egGzpD93Et1JrHINjrYtMaYl3IXeLj02zwmon+K/ahrIRwezuFo4VaS59TejCY:bGFRGnsrYaLlZpwp+wa5I9zI5kjCY
• TLSH: T18933CFF3108BED4C7EDA970369F71454714ACA89A2325A7084DC7F6CD97C9BCAD50A20
• Submitted as: fe83c3_62d145eeebe9418cbfad72138899338b.pdf
• File type: pdf · Size: 51949 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=video+converter+apk+for+windows, http://tixavuz.vinesbakery.com/uploads/1/3/1/3/131379578/depoteboponedof.pdf, http://files.vote4georgechen.com/uploads/1/3/0/7/130776111/botobunimubiwufofek.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=video+converter+apk+for+windows
• http://tixavuz.vinesbakery.com/uploads/1/3/1/3/131379578/depoteboponedof.pdf
• http://files.vote4georgechen.com/uploads/1/3/0/7/130776111/botobunimubiwufofek.pdf
• http://files.alicekelseylewis.net/uploads/1/3/1/4/131438453/d67d0edc6.pdf
• http://minedav.ibizarentaudio.com/uploads/1/3/1/3/131398140/32100.pdf
• https://840b44bb-8ee4-481c-a6a7-554147c16ef8.filesusr.com/ugd/268ab1_ab1f3f60d97a44f39b5b03676edf72a4.pdf?index=true
• https://f289e215-a8eb-4c38-8cf7-c73c024e0c5b.filesusr.com/ugd/7f46b5_bb8f8b0259a94f23aaa667ce7507855b.pdf?index=true
• https://966ce6f6-95e4-437d-abb9-263d1b52457c.filesusr.com/ugd/cacfd7_bae48fa529134866b6a031fb5081925e.pdf?index=true
• https://3d714eb3-fa74-418c-9cc6-e040006e01ac.filesusr.com/ugd/bf0735_4067628972fe40f39e7e2f64449f8e27.pdf?index=true
• https://1bee6380-b40e-49f7-953b-1dddb2e69917.filesusr.com/ugd/07e02c_ad506802ea3b4cfcae44e195b8ad0c8c.pdf?index=true
• https://e694c2e9-a44e-4d6b-9ef6-01721d925c01.filesusr.com/ugd/610d21_fbdb21533a714efda0e36ff87485af57.pdf?index=true
• https://e7f3a18f-655a-443d-94fc-4b410d7a0992.filesusr.com/ugd/3f8d85_19f9a6a3056e4159a14297c3aaa7bd14.pdf?index=true
• https://1e03311a-72f7-486f-a174-27e418b01595.filesusr.com/ugd/61b8bf_01e621fb38d04afbb76430d9f32a3b4d.pdf?index=true
• https://c3f03ef5-5d46-427c-b53b-918515100afc.filesusr.com/ugd/61b8bf_cebabe95ab3942ae82b2758b87f24389.pdf?index=true
• https://57d5d3b4-a6bf-4c24-9a19-017821cd0bbc.filesusr.com/ugd/9d869b_ae1a2d66eaa54517b4352254cf90bf91.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• tixavuz.vinesbakery.com
• files.vote4georgechen.com
• files.alicekelseylewis.net
• minedav.ibizarentaudio.com
• 840b44bb-8ee4-481c-a6a7-554147c16ef8.filesusr.com
• f289e215-a8eb-4c38-8cf7-c73c024e0c5b.filesusr.com
• 966ce6f6-95e4-437d-abb9-263d1b52457c.filesusr.com
• 3d714eb3-fa74-418c-9cc6-e040006e01ac.filesusr.com
• 1bee6380-b40e-49f7-953b-1dddb2e69917.filesusr.com
• e694c2e9-a44e-4d6b-9ef6-01721d925c01.filesusr.com
• e7f3a18f-655a-443d-94fc-4b410d7a0992.filesusr.com
• 1e03311a-72f7-486f-a174-27e418b01595.filesusr.com
• c3f03ef5-5d46-427c-b53b-918515100afc.filesusr.com
• 57d5d3b4-a6bf-4c24-9a19-017821cd0bbc.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report