MALICIOUS — 69695d_b6efb9b044db4badba983f0987557f53.pdf

MALICIOUS — 69695d_b6efb9b044db4badba983f0987557f53.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 283f299a5b41c46bb150e5327d7ccd2f8b6e0d7750e7c2a17979ac3d6b83f0a8
• SHA-1: 6c6f556bdbf540d11a949b4b6a0992cec9c0ec61
• MD5: 1d1601966d75ceb3878d23a6e230e920
• ssdeep: 1536:iGFZA5PEnnSgN1Y00cqJfXKGt56tCwb3EGlhPS:bFZcEnN1Y00nfz5/wb3EGl0
• TLSH: T1C034AFF32057EC9C7A8BDB035CAA2199988AD6499236C650489CB73CC4BC6FD7F01A11
• Submitted as: 69695d_b6efb9b044db4badba983f0987557f53.pdf
• File type: pdf · Size: 52783 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=google+sheets+loop, https://45afafbb-cfe2-4eb0-82e2-7776ec9cd11f.filesusr.com/ugd/3ddeef_5bed49e3d5cc4f3c8385365548992b1a.pdf?index=true, https://1bc132d0-3300-4058-a437-0cf9485a9881.filesusr.com/ugd/edb4a7_bb0645ae753f48d18ca4b5780b631880.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=google+sheets+loop
• https://45afafbb-cfe2-4eb0-82e2-7776ec9cd11f.filesusr.com/ugd/3ddeef_5bed49e3d5cc4f3c8385365548992b1a.pdf?index=true
• https://1bc132d0-3300-4058-a437-0cf9485a9881.filesusr.com/ugd/edb4a7_bb0645ae753f48d18ca4b5780b631880.pdf?index=true
• https://136e6361-ab43-4f80-869a-f18666b49f77.filesusr.com/ugd/b463f2_f05a7abd33ee4ebe960a9c0ddeb37b79.pdf?index=true
• https://8d6b25b4-4245-4c8e-92bf-c679ef326329.filesusr.com/ugd/3e7897_1a55596f90f14e0182bf6328728b42c7.pdf?index=true
• https://15a38af7-7aed-4ad4-97dd-9b62bae7f06d.filesusr.com/ugd/8e7730_087bd762caec43a6aa0f6944c39e25f9.pdf?index=true
• https://3a856c0d-4055-4a5d-b935-74a6803974f2.filesusr.com/ugd/3225da_28eb47b3f65c4ceeb885104b84ad6800.pdf?index=true
• https://fa62787e-346e-4dd5-9342-eaca4a817e43.filesusr.com/ugd/1e52da_03c3a3b53d984cee8236ab13f7dac765.pdf?index=true
• https://e620f5ef-d322-4cd8-903d-40c78cc9988e.filesusr.com/ugd/95ea6b_169d7a77ab724fd49236b98484fdc9c0.pdf?index=true
• https://f1369f74-662e-4a3f-a5a3-4c7dcbd1fb37.filesusr.com/ugd/f4de5e_b0ea1594553e43488c2dd49060049044.pdf?index=true
• https://4a16b753-7dce-4b16-a989-f23475e0bc4d.filesusr.com/ugd/834936_b5a834f2400e44719ed01f1998977c3b.pdf?index=true
• http://files.ires-8.com/uploads/1/3/1/3/131379510/wibuxukam.pdf
• http://files.shackboldon.com/uploads/1/3/1/8/131856186/sikufa_xefowoxejegi_pikikiletedemo_mosikonetuju.pdf
• http://files.narragansettgunclub.com/uploads/1/3/0/8/130815009/4292611.pdf
• http://zodupo.equusmedendi.com/uploads/1/3/1/3/131379213/lanafurukizi.pdf
• https://cdn.shopify.com/s/files/1/0429/8421/0583/files/67529218800.pdf
• https://cdn.shopify.com/s/files/1/0428/5346/6271/files/folobilizutitolad.pdf
• https://cdn.shopify.com/s/files/1/0428/9835/8432/files/welilavuruwad.pdf
• https://cdn.shopify.com/s/files/1/0440/0221/4046/files/tisevowegugilirifizadisaj.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• 45afafbb-cfe2-4eb0-82e2-7776ec9cd11f.filesusr.com
• 1bc132d0-3300-4058-a437-0cf9485a9881.filesusr.com
• 136e6361-ab43-4f80-869a-f18666b49f77.filesusr.com
• 8d6b25b4-4245-4c8e-92bf-c679ef326329.filesusr.com
• 15a38af7-7aed-4ad4-97dd-9b62bae7f06d.filesusr.com
• 3a856c0d-4055-4a5d-b935-74a6803974f2.filesusr.com
• fa62787e-346e-4dd5-9342-eaca4a817e43.filesusr.com
• e620f5ef-d322-4cd8-903d-40c78cc9988e.filesusr.com
• f1369f74-662e-4a3f-a5a3-4c7dcbd1fb37.filesusr.com
• 4a16b753-7dce-4b16-a989-f23475e0bc4d.filesusr.com
• files.ires-8.com
• files.shackboldon.com
• files.narragansettgunclub.com
• zodupo.equusmedendi.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report