MALICIOUS — 3bbd68_0a1f8a65c8fc4822854b86251bf0424f.pdf

MALICIOUS — 3bbd68_0a1f8a65c8fc4822854b86251bf0424f.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 279dcbc8eb07b064ab5059f8f27796b1c8ff274042bbc970ba30bc6036b27fcc
• SHA-1: 50496a42774eb5b5397560a9f6bc27651e7ce697
• MD5: 3eec03bba7477fd7b5d954d93fb2be60
• ssdeep: 1536:dGFqfJXKa91MZ3txnTozSoJUxFF46fEeR4kLv5Z59VMhi2Otgkq5v:gFqhXp18xnTo+xFlsO4kNZ59VMsptgkS
• TLSH: T1A437D0F3146BDD8D26DB9B03A8A6216AA105CE89913397B015CC7F3DC0B96FC1D50A61
• Submitted as: 3bbd68_0a1f8a65c8fc4822854b86251bf0424f.pdf
• File type: pdf · Size: 71030 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=targaryen+lannister+family+tree, https://9630c087-1ada-489e-b051-187642f0c93e.filesusr.com/ugd/48bf55_953cd97c56e84ea8acfe890328d444b9.pdf?index=true, https://e8b1e78e-7564-44af-894b-e93d5d972856.filesusr.com/ugd/f96b02_b8c3c5dfb2744a3eb5a000352c7a420c.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=targaryen+lannister+family+tree
• https://9630c087-1ada-489e-b051-187642f0c93e.filesusr.com/ugd/48bf55_953cd97c56e84ea8acfe890328d444b9.pdf?index=true
• https://e8b1e78e-7564-44af-894b-e93d5d972856.filesusr.com/ugd/f96b02_b8c3c5dfb2744a3eb5a000352c7a420c.pdf?index=true
• https://5277447b-bae9-44f2-bd11-159b4c690fbe.filesusr.com/ugd/12daa7_9b6f9a63773d43dba4b9883eef787fc7.pdf?index=true
• https://335f846c-d3ed-481e-9ded-0caf5cc954ef.filesusr.com/ugd/417718_da939661c2eb4149a9dd47b02da1bbd4.pdf?index=true
• https://02d3bd3d-dbf8-4d92-a34a-acdb6dc49a04.filesusr.com/ugd/3254bf_f1b1294518a741b991c9f56ec81137ca.pdf?index=true
• https://19e94ced-bc1e-4a61-af93-29dcca5e4882.filesusr.com/ugd/bc0b97_07d0d6bb387e43afa29904c6dc71ca1c.pdf?index=true
• http://lutuxudoj.moparsunlimited.net/uploads/1/3/1/3/131381787/lojidepa.pdf
• http://bajal.provisopartners.com/uploads/1/3/0/7/130740073/kuwok_zezunizerir_piposu.pdf
• https://cdn.shopify.com/s/files/1/0432/6440/9764/files/givuzeremiromujarapi.pdf
• https://cdn.shopify.com/s/files/1/0434/0006/9270/files/asuran_theme_music_bgm.pdf
• https://cdn.shopify.com/s/files/1/0436/3393/4496/files/lovalog.pdf
• https://cdn.shopify.com/s/files/1/0431/4791/9522/files/nukes.pdf
• https://cdn.shopify.com/s/files/1/0436/3078/8758/files/redilufor.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• 9630c087-1ada-489e-b051-187642f0c93e.filesusr.com
• e8b1e78e-7564-44af-894b-e93d5d972856.filesusr.com
• 5277447b-bae9-44f2-bd11-159b4c690fbe.filesusr.com
• 335f846c-d3ed-481e-9ded-0caf5cc954ef.filesusr.com
• 02d3bd3d-dbf8-4d92-a34a-acdb6dc49a04.filesusr.com
• 19e94ced-bc1e-4a61-af93-29dcca5e4882.filesusr.com
• lutuxudoj.moparsunlimited.net
• bajal.provisopartners.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report