MALICIOUS — 9d66c7_2ca51504a53d4664ad147abefb86c933.pdf

MALICIOUS — 9d66c7_2ca51504a53d4664ad147abefb86c933.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 2e228a38e6c12ca5dfd24ca224b00fbd944c2061b383b7a23cbe615c4c0a2305
• SHA-1: 7916baac05f51c62de1ece3ccfca7d5cf7bd8eda
• MD5: 0e1d4aeba94fd52e295b2841d4919124
• ssdeep: 768:mBgGzpDIAIZo98uwnMVzZeZym24Ye8a4X6uqvJtBU7qTTB0:ZGFUAIOFwUzQtYvaixaBUGTl0
• TLSH: T1C8328EF310A7DD8C7A8B6F175FEA215DA045C7492036EAA048D8776CC4787BEAE14630
• Submitted as: 9d66c7_2ca51504a53d4664ad147abefb86c933.pdf
• File type: pdf · Size: 43811 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=pokemon+crystal+randomizer+rom+download+android, https://2ae5bb02-770b-49ab-961e-46bfbf6624b6.filesusr.com/ugd/cdfdba_c12b7816bbdd4d51949ca20ffcad1d8e.pdf?index=true, https://4fdf4489-7b22-4fe7-81ab-010e81ec55b1.filesusr.com/ugd/0a84ca_972bb36609c244eeb6bb41c09f774acf.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=pokemon+crystal+randomizer+rom+download+android
• https://2ae5bb02-770b-49ab-961e-46bfbf6624b6.filesusr.com/ugd/cdfdba_c12b7816bbdd4d51949ca20ffcad1d8e.pdf?index=true
• https://4fdf4489-7b22-4fe7-81ab-010e81ec55b1.filesusr.com/ugd/0a84ca_972bb36609c244eeb6bb41c09f774acf.pdf?index=true
• https://2cfd4285-9233-4079-84df-8090aeacac25.filesusr.com/ugd/d775a9_73ef6bc780944b4598308f99f47067d8.pdf?index=true
• https://d1faa39f-0dbc-47dc-bf01-d8a5f0a14cc4.filesusr.com/ugd/92ee2b_dc633ac4788547eab4a945d6fc7b3c3c.pdf?index=true
• https://2360824b-a26b-4dbf-a09a-f9c1b0087c67.filesusr.com/ugd/011e4b_0ee36013cb234fc4934ea1f2e1f3f26f.pdf?index=true
• https://7cf9ac34-9774-46c6-be34-5e89b91b912b.filesusr.com/ugd/c88839_cc54847b429348d0bc2a24fec8ef67e1.pdf?index=true
• https://ce897b55-0e2f-43e8-8633-c698fd586f50.filesusr.com/ugd/3d0627_fa56f6e337bc4cd496d4bedac1ed38aa.pdf?index=true
• https://f2a4842d-6c93-4289-b04f-b213edb49c2e.filesusr.com/ugd/7ef0dc_f15834fac73142b6ab98932f8ff6f2a4.pdf?index=true
• https://4c46edf0-754f-4fef-8094-dbf24e9e1bc3.filesusr.com/ugd/909b15_7b2603a7cd9749a396da84a933673c52.pdf?index=true
• http://files.ftworthdrywallsolutions.com/uploads/1/3/1/4/131406659/simojanadur-nokoxovuvota-salusu.pdf
• http://xovajexa.appgeogconf.org/uploads/1/3/1/3/131384260/jomegakuv-fizugubedewujax-xikiladebot-taxoxojida.pdf
• http://files.micasitarentals.com/uploads/1/3/1/4/131406744/tibitu.pdf
• https://cdn.shopify.com/s/files/1/0431/8812/5857/files/51005449744.pdf
• https://cdn.shopify.com/s/files/1/0433/3276/3801/files/miocardiopatia_dilatada_etiologia.pdf
• https://cdn.shopify.com/s/files/1/0432/8236/6629/files/fopepuwatiguluj.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• 2ae5bb02-770b-49ab-961e-46bfbf6624b6.filesusr.com
• 4fdf4489-7b22-4fe7-81ab-010e81ec55b1.filesusr.com
• 2cfd4285-9233-4079-84df-8090aeacac25.filesusr.com
• d1faa39f-0dbc-47dc-bf01-d8a5f0a14cc4.filesusr.com
• 2360824b-a26b-4dbf-a09a-f9c1b0087c67.filesusr.com
• 7cf9ac34-9774-46c6-be34-5e89b91b912b.filesusr.com
• ce897b55-0e2f-43e8-8633-c698fd586f50.filesusr.com
• f2a4842d-6c93-4289-b04f-b213edb49c2e.filesusr.com
• 4c46edf0-754f-4fef-8094-dbf24e9e1bc3.filesusr.com
• files.ftworthdrywallsolutions.com
• xovajexa.appgeogconf.org
• files.micasitarentals.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report