MALICIOUS — 229b11_239a391c5cf34fbe8b2bb5ed099d4a0e.pdf

MALICIOUS — 229b11_239a391c5cf34fbe8b2bb5ed099d4a0e.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

SHA-256: 28ac2b873256d41ccd21da805c3db68e955b2316d367121964a423597fb309c7
SHA-1: b8aac69c567d2a91e8bc547dc886322501ee4cf3
MD5: b0b8f190835ee6c605e045cfcecfaf45
ssdeep: 768:XgGzpDI5XjneF0XAeO3vRGbVT2xWbrrjbPWJ6ht5/MNM/EEwSys7R4i:wGFc5dAe9bVT2AbrHTK6htBMkZ7R4i
TLSH: T17B318DF35057EC8C6A8A5F03B9A705582445DBC92133E6A048C8BB7CC9BC1EDAF41A75
Submitted as: 229b11_239a391c5cf34fbe8b2bb5ed099d4a0e.pdf
File type: pdf · Size: 43217 bytes
Verdict: malicious (88/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ttraff.ru/wix?keyword=the+art+of+profiling+dan+korem+pdf+download, https://0752870a-291c-4ea5-944a-5fbfa2128e2f.filesusr.com/ugd/ceb2e8_4d7cd2d7a7484ae2a1e18bbddd034348.pdf?index=true, https://f67927a1-c2ac-4e81-aa17-57fe7e863643.filesusr.com/ugd/ebc5f9_568513eb6ceb487bb736a0188b4d986c.pdf?index=true - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://ttraff.ru/wix?keyword=the+art+of+profiling+dan+korem+pdf+download
https://0752870a-291c-4ea5-944a-5fbfa2128e2f.filesusr.com/ugd/ceb2e8_4d7cd2d7a7484ae2a1e18bbddd034348.pdf?index=true
https://f67927a1-c2ac-4e81-aa17-57fe7e863643.filesusr.com/ugd/ebc5f9_568513eb6ceb487bb736a0188b4d986c.pdf?index=true
https://d45e78ac-4559-4c55-84e7-9754fcca3399.filesusr.com/ugd/6e13d9_9b2a72566a9c49249c51bf97448bd914.pdf?index=true
https://95e82e45-b20b-403c-bad6-34f0b4889eb7.filesusr.com/ugd/8acad3_8aecac751b5043d48b09430e1489148f.pdf?index=true
https://1654b786-cefb-44ff-a249-96d5ae0110b6.filesusr.com/ugd/d31907_0ac82db2047242c5a68c9855c6c8f459.pdf?index=true
http://fopos.chipgeorgia.com/uploads/1/3/0/9/130969186/2894862.pdf
https://560535e6-3980-4a8f-bd55-772296553591.filesusr.com/ugd/3a38e0_0ace9de55c294d299a1faa4744541e43.pdf?index=true
https://00df15d7-94fa-48e4-84b2-fd2527d4d351.filesusr.com/ugd/4f92c1_8b0033303a1c49a19bc9d93cad69f43f.pdf?index=true
https://cdn.shopify.com/s/files/1/0432/5854/4292/files/53351161208.pdf
https://cdn.shopify.com/s/files/1/0430/2887/3367/files/ten_commandments_tagalog.pdf
https://cdn.shopify.com/s/files/1/0462/4846/0439/files/luxixalisinipojap.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ttraff.ru
0752870a-291c-4ea5-944a-5fbfa2128e2f.filesusr.com
f67927a1-c2ac-4e81-aa17-57fe7e863643.filesusr.com
d45e78ac-4559-4c55-84e7-9754fcca3399.filesusr.com
95e82e45-b20b-403c-bad6-34f0b4889eb7.filesusr.com
1654b786-cefb-44ff-a249-96d5ae0110b6.filesusr.com
fopos.chipgeorgia.com
560535e6-3980-4a8f-bd55-772296553591.filesusr.com
00df15d7-94fa-48e4-84b2-fd2527d4d351.filesusr.com
cdn.shopify.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report