MALICIOUS — 440e29_bb9e4288f37949deb8efa6446e7e3529.pdf

MALICIOUS — 440e29_bb9e4288f37949deb8efa6446e7e3529.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: 2915d1506a9f8747b12e53e069ee44e8699667aa2f534bc62f625567bc73cf0e
• SHA-1: 28d5c88feda9e94bfce264753bcda9972b2353b6
• MD5: 398d2f9767acce9f621c66e1c9108701
• ssdeep: 768:NgGzpDgzBmoEJOcmMsQ4xD4n2vpYHubzhxKCwxmvQipUyhZXHkteobCgCOppoG+M:uGF0wmMpFn2BYH020QipRhZXEcoQOpp3
• TLSH: T13C33AEF71067DD4C6ACAEB4379DA2449A05DC2C86172727859DC7B6CC4BC3BD6E20A20
• Submitted as: 440e29_bb9e4288f37949deb8efa6446e7e3529.pdf
• File type: pdf · Size: 49054 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=mspy+app+apk+full+crack+version, https://cdn.shopify.com/s/files/1/0431/6112/5013/files/laweximagozisutiperiwufaw.pdf, https://cdn.shopify.com/s/files/1/0430/2631/7473/files/kevulupinaxe.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=mspy+app+apk+full+crack+version
• https://cdn.shopify.com/s/files/1/0431/6112/5013/files/laweximagozisutiperiwufaw.pdf
• https://cdn.shopify.com/s/files/1/0430/2631/7473/files/kevulupinaxe.pdf
• https://cdn.shopify.com/s/files/1/0431/0836/8545/files/nezugopek.pdf
• http://files.mysugardumplings.com/uploads/1/3/0/7/130738641/tozadijuvupo.pdf
• http://torazom.friendshipfiles.com/uploads/1/3/0/8/130874588/tujesidedupo_nobewo.pdf
• https://22a9cc9e-99bc-4ea2-ba81-3e5fe113fbe9.filesusr.com/ugd/45fd81_2b54c4ccd75843749ee31be32f4f4bbf.pdf?index=true
• https://14aba9b8-8f4f-41fc-a43d-2fb466f93f5b.filesusr.com/ugd/384ea4_b225470e35634fbeacdc45d3c28e3935.pdf?index=true
• https://ea9ad652-7068-4ecc-b889-28e925308e8b.filesusr.com/ugd/9ea91e_43d376d570254d83a49ef195b1908b8d.pdf?index=true
• https://cdn.shopify.com/s/files/1/0433/9187/7283/files/55698598708.pdf
• https://cdn.shopify.com/s/files/1/0447/2622/3001/files/basic_networking_concepts_ccna.pdf
• https://cdn.shopify.com/s/files/1/0433/3764/6245/files/99481912119.pdf
• https://cdn.shopify.com/s/files/1/0430/9676/8673/files/kidubidejogikawuzepob.pdf
• https://cdn.shopify.com/s/files/1/0434/7448/5400/files/74211883649.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• cdn.shopify.com
• files.mysugardumplings.com
• torazom.friendshipfiles.com
• 22a9cc9e-99bc-4ea2-ba81-3e5fe113fbe9.filesusr.com
• 14aba9b8-8f4f-41fc-a43d-2fb466f93f5b.filesusr.com
• ea9ad652-7068-4ecc-b889-28e925308e8b.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report