MALICIOUS — d38238_e3f5d69b6f4f4666a9e9d1600c330845.pdf

MALICIOUS — d38238_e3f5d69b6f4f4666a9e9d1600c330845.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 237bd6e711d44664be827d4f7d95428938e16b04f6055aa92deec5fea7d114a5
• SHA-1: 1d5395a221b94e6f38f0fa0ef0a4a0eef8f3fff4
• MD5: b7a148f26dfda13764a818a3efe0cdec
• ssdeep: 768:vgGzpDUXS1gVEXxsjOxaBssmVKCi39n/J/68cqyx3OEf+dsH8c:YGFoXdOSsFVKCitnR68cNkEf0sH8c
• TLSH: T107306DF35057ED8C6A8BAB03AEF7105A604AC78D6136D7A045D8773CC87CABD6E40A11
• Submitted as: d38238_e3f5d69b6f4f4666a9e9d1600c330845.pdf
• File type: pdf · Size: 36854 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=alpha+elite+65+manual, http://mobakeb.go-teacher.com/uploads/1/3/0/7/130775027/lotubisojimusow.pdf, http://files.thewrightograph.com/uploads/1/3/2/6/132683367/jemub_jenamaliv_sininopireliso.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=alpha+elite+65+manual
• http://mobakeb.go-teacher.com/uploads/1/3/0/7/130775027/lotubisojimusow.pdf
• http://files.thewrightograph.com/uploads/1/3/2/6/132683367/jemub_jenamaliv_sininopireliso.pdf
• http://files.kidsliturgy.com.au/uploads/1/3/1/6/131636644/e4ac0.pdf
• http://norud.duesouthstore.com/uploads/1/3/0/7/130739640/a420e3f56.pdf
• http://zebajira.thinkingdesignjh.com/uploads/1/3/0/8/130814328/basigowopudu_madedopabezeje_voxag.pdf
• http://files.consciousbirthmanila.com/uploads/1/3/1/4/131484133/gebedagozadiba.pdf
• http://vorer.watsonhill.com/uploads/1/3/1/3/131383791/3754267.pdf
• http://files.omargr.com/uploads/1/3/1/4/131406507/7006141.pdf
• http://defoza.barnsofsummerscounty.com/uploads/1/3/2/6/132681482/vepezabomeji.pdf
• http://rexito.timandkallie.com/uploads/1/3/0/7/130739393/6161999.pdf
• https://cdn.shopify.com/s/files/1/0435/6138/6147/files/determination_of_bleeding_time.pdf
• https://cdn.shopify.com/s/files/1/0429/2398/3001/files/lobogumulelase.pdf
• https://cdn.shopify.com/s/files/1/0433/7840/9622/files/diagramming_sentences_worksheets.pdf
• https://cdn.shopify.com/s/files/1/0431/2160/6818/files/dry_brined_turkey_with_sheet_pan_gravy.pdf
• https://cdn.shopify.com/s/files/1/0435/0086/3643/files/29454331131.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• mobakeb.go-teacher.com
• files.thewrightograph.com
• files.kidsliturgy.com.au
• norud.duesouthstore.com
• zebajira.thinkingdesignjh.com
• files.consciousbirthmanila.com
• vorer.watsonhill.com
• files.omargr.com
• defoza.barnsofsummerscounty.com
• rexito.timandkallie.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report