MALICIOUS — c4dbd3_916bdc5d29af4b1db60f678e8e3265b2.pdf

MALICIOUS — c4dbd3_916bdc5d29af4b1db60f678e8e3265b2.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 2df6802b5eda981fe51f091e98bdf3ee18dad6430cb1abd4e3754bf1ed0917a8
• SHA-1: 8cb9948bd28efbd95ec8994eedc139a2d48fdbbb
• MD5: 90b69c97a6fda071113ca3762d03aef7
• ssdeep: 768:ggGzpD5j9ywfXtKtQ+XUWbxKmQMaSgSnVDaYMKhmaf/imWGgSC9phKZ:tGFl9J+EJz/oEYT7famW0C9phKZ
• TLSH: T18333BFF380ABEC9C3A8A9B03B9B641542189C68C7137D7A059897B2DC57C5BDEE01D70
• Submitted as: c4dbd3_916bdc5d29af4b1db60f678e8e3265b2.pdf
• File type: pdf · Size: 51949 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=toy+story+4+full+movie+free+online+reddit, https://15fd6825-a00b-4f2a-8bfb-efe563c6b61c.filesusr.com/ugd/9c0842_92cccef11f2f4350ba1ff63d725c4ac2.pdf?index=true, https://c781c13c-688c-4a7b-bf31-aac71d002f53.filesusr.com/ugd/bba345_57cabc30e8404cfa99d1ad96a4b44d70.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=toy+story+4+full+movie+free+online+reddit
• https://15fd6825-a00b-4f2a-8bfb-efe563c6b61c.filesusr.com/ugd/9c0842_92cccef11f2f4350ba1ff63d725c4ac2.pdf?index=true
• https://c781c13c-688c-4a7b-bf31-aac71d002f53.filesusr.com/ugd/bba345_57cabc30e8404cfa99d1ad96a4b44d70.pdf?index=true
• https://f4e95808-2229-49dc-acac-accf44e4c4b8.filesusr.com/ugd/868401_c770461c503940b499b4e8fce23a5094.pdf?index=true
• https://cdn.shopify.com/s/files/1/0436/5815/0046/files/rodusevogefaganoxuzes.pdf
• http://files.chicagofreeforall.com/uploads/1/3/1/4/131438275/9940518.pdf
• http://pulubal.stcproshop.com/uploads/1/3/1/3/131380623/8bdcd65ee6dd.pdf
• http://files.highhorsehill.com/uploads/1/3/2/8/132815317/talugavow-fajev.pdf
• http://seput.cribusinesssystems.com/uploads/1/3/1/3/131397997/karuwogibi_fepan.pdf
• http://gemuzit.engramikhalil.com/uploads/1/3/2/3/132302921/walavafiguneranelig.pdf
• https://cdn.shopify.com/s/files/1/0433/3692/5342/files/cardinal_dan_ordinal_number.pdf
• https://cdn.shopify.com/s/files/1/0430/5122/1143/files/mowubomuko.pdf
• https://cdn.shopify.com/s/files/1/0429/2860/3295/files/fuwukut.pdf
• https://cdn.shopify.com/s/files/1/0429/0953/2316/files/gifez.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• 15fd6825-a00b-4f2a-8bfb-efe563c6b61c.filesusr.com
• c781c13c-688c-4a7b-bf31-aac71d002f53.filesusr.com
• f4e95808-2229-49dc-acac-accf44e4c4b8.filesusr.com
• cdn.shopify.com
• files.chicagofreeforall.com
• pulubal.stcproshop.com
• files.highhorsehill.com
• seput.cribusinesssystems.com
• gemuzit.engramikhalil.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report