MALICIOUS — d63aaf_b239fdd741c947a39036c99e5ff109f2.pdf

MALICIOUS — d63aaf_b239fdd741c947a39036c99e5ff109f2.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 285be95f7cf13fd6d5d7c1c1ffb46d5874cdc6ddb538314626944590b1f54c2f
• SHA-1: 62f512fa24d7f58eeb5e2209374033b238b71cbe
• MD5: 2fe7473c9100ec3b76263fb0194cd4a1
• ssdeep: 768:agGzpDEhaWzN/UqsGlPug/j1gy8UJwCFXCKcXut7bDd3IwO4eYXJqH:HGFIjzMOZ/86h0ulvd4ZMZqH
• TLSH: T1F533C0F3504BED4CA98F5F07AB962048A0C3A6892132966458D8373CC4BCAFD7E54A71
• Submitted as: d63aaf_b239fdd741c947a39036c99e5ff109f2.pdf
• File type: pdf · Size: 50046 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=best+friend+forever+in+different+languages, https://f8b14319-aedd-4f26-8ccc-e628ecb5a7ed.filesusr.com/ugd/74e905_860f6702d69b4ff586ec8fa58cb665c2.pdf?index=true, https://c7649d9d-1095-4d0b-820b-e76d3a02362a.filesusr.com/ugd/a91264_99718c8adc6f4569ac75d32cea69af54.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=best+friend+forever+in+different+languages
• https://f8b14319-aedd-4f26-8ccc-e628ecb5a7ed.filesusr.com/ugd/74e905_860f6702d69b4ff586ec8fa58cb665c2.pdf?index=true
• https://c7649d9d-1095-4d0b-820b-e76d3a02362a.filesusr.com/ugd/a91264_99718c8adc6f4569ac75d32cea69af54.pdf?index=true
• https://54784421-7987-4ab8-a6c9-9e2d4fe5adcc.filesusr.com/ugd/2813e2_f367a65ea403457a87779c1007af53a9.pdf?index=true
• http://files.barryjayjewelers.com/uploads/1/3/1/4/131454355/pesewovezu-ligat.pdf
• http://poweme.aislynnesimagesphotography.com/uploads/1/3/0/9/130969937/naxigotiri-mutolejo-sifav.pdf
• https://d79841f0-72f4-4032-9a75-658a50a71dd7.filesusr.com/ugd/b65acf_9ec6a51e6cd84cbf96d995a3892301b9.pdf?index=true
• https://6f9afa77-fdf0-4185-9feb-ffbbc6910987.filesusr.com/ugd/43d598_34bad9f9735f4e889404814ad2cad7fd.pdf?index=true
• https://f9a2d640-8f9f-439d-8803-7d123f6263bf.filesusr.com/ugd/03ae60_04baeaf4b0a14b1baeab738502ead498.pdf?index=true
• https://183a2a57-0f4d-4773-8f87-db7057b098c4.filesusr.com/ugd/9ea91e_8c63362e467a4c1fa64acc1079fc7076.pdf?index=true
• https://ee069ec6-1e8e-4f2e-876d-eae9390f4d25.filesusr.com/ugd/33a16d_a7ba58ca561846b3a137975a05a341ed.pdf?index=true
• https://cbafcfd8-b3a0-4f12-98f6-ea01b216f298.filesusr.com/ugd/ceb2e8_3916b828144f4d199cbfae3e0debde8c.pdf?index=true
• https://a5c4cdc8-8a1b-47d2-a41f-dca0704a3c57.filesusr.com/ugd/cb4a18_2b6d0336081a44dc9a64869c2699cc60.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• f8b14319-aedd-4f26-8ccc-e628ecb5a7ed.filesusr.com
• c7649d9d-1095-4d0b-820b-e76d3a02362a.filesusr.com
• 54784421-7987-4ab8-a6c9-9e2d4fe5adcc.filesusr.com
• files.barryjayjewelers.com
• poweme.aislynnesimagesphotography.com
• d79841f0-72f4-4032-9a75-658a50a71dd7.filesusr.com
• 6f9afa77-fdf0-4185-9feb-ffbbc6910987.filesusr.com
• f9a2d640-8f9f-439d-8803-7d123f6263bf.filesusr.com
• 183a2a57-0f4d-4773-8f87-db7057b098c4.filesusr.com
• ee069ec6-1e8e-4f2e-876d-eae9390f4d25.filesusr.com
• cbafcfd8-b3a0-4f12-98f6-ea01b216f298.filesusr.com
• a5c4cdc8-8a1b-47d2-a41f-dca0704a3c57.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report