MALICIOUS — c63dba_1c671b1a85124d36a9a15e3b8a0d32d7.pdf

MALICIOUS — c63dba_1c671b1a85124d36a9a15e3b8a0d32d7.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 2fbfc9ee817a2095dbb541a5de600b0388c291b851c8ce4559e47cd008da83f8
• SHA-1: c457f4a7ba2915e78d32dbd77d68ba203e272b91
• MD5: e1512cb1c7e49ecd176801a18dfb553b
• ssdeep: 768:mgGzpDGFvF2iHUKxzlk/0YnG0+2RW0riP3ELUxX+:zGFatF5zlk/0x080riP3ELUxX+
• TLSH: T19C329EF310ABED4CB9965B136DAB116AA485D28DA133A76044CC372CD4BC5FCBE60D60
• Submitted as: c63dba_1c671b1a85124d36a9a15e3b8a0d32d7.pdf
• File type: pdf · Size: 45612 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=pokemon+go+latest+version+apk, http://files.gettingtogethernow.com/uploads/1/3/1/4/131409909/gejebujevijome-buvarutulowubib-lasovekazotub-gupifewawatepop.pdf, http://juneb.bronamartin.org/uploads/1/3/2/6/132695361/0812a3282367.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=pokemon+go+latest+version+apk
• http://files.gettingtogethernow.com/uploads/1/3/1/4/131409909/gejebujevijome-buvarutulowubib-lasovekazotub-gupifewawatepop.pdf
• http://juneb.bronamartin.org/uploads/1/3/2/6/132695361/0812a3282367.pdf
• http://lurunufev.dishingitupgame.com/uploads/1/3/2/8/132814977/tepodubawilovi.pdf
• http://wawod.studio-macs.com/uploads/1/3/2/6/132695569/cc4d4d8e1edda.pdf
• http://mipid.thetotalyousalon.com/uploads/1/3/1/4/131406656/8657521.pdf
• https://69706681-db1b-4d35-b37e-a1e90d20c5f9.filesusr.com/ugd/ea2f88_89530ccf9e864142b545c62b7b4f30fa.pdf?index=true
• https://f84c539a-369d-47b7-be7a-11d7fe6e460a.filesusr.com/ugd/a07927_c193d9e1646146bfb8b290bd76c99b0b.pdf?index=true
• https://2a1ac6bc-9ba8-47bf-b85b-e76ecfa1254c.filesusr.com/ugd/0aab01_48f8559506b2466c95f8d2e54edbae8f.pdf?index=true
• https://060badb2-51c6-40fe-b811-b3ea9c6ce1e7.filesusr.com/ugd/02631b_a1a61ea8976c4aebaa3d149f23d2f2ce.pdf?index=true
• https://5b9889b8-641d-4e0a-8500-1a159794b799.filesusr.com/ugd/37987b_13b4bb2e6c2f48209cdd72dea3e1410d.pdf?index=true
• https://d5d5439d-371b-4963-98a3-33b21720f19c.filesusr.com/ugd/b91566_03cbea51be1347cab0069c94c03acc15.pdf?index=true
• https://ebcf3d5f-c138-473b-8ee8-f373a46117cc.filesusr.com/ugd/fe83c3_2a6eb99b476b4d53a1d08955667eb940.pdf?index=true
• https://2f699457-4154-4af7-adb7-c8087d26bab3.filesusr.com/ugd/c8df25_812f40f09ec3468e956c82b9053ef571.pdf?index=true
• https://8e7b04f5-0934-4263-a770-f0648c000a04.filesusr.com/ugd/b0c717_67272b5bdc8a4ef5ba96c14708062fc6.pdf?index=true
• https://870c00f0-0a52-4f85-9df6-ec3e6b81b05f.filesusr.com/ugd/28146e_ccfa6b4ff5b840f9941af91ec6aee6ef.pdf?index=true
• https://cdn.shopify.com/s/files/1/0428/2672/7580/files/92810845501.pdf
• https://cdn.shopify.com/s/files/1/0431/3507/4465/files/nomelewimonukurof.pdf
• https://cdn.shopify.com/s/files/1/0469/0319/7856/files/dilekaxofovame.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• files.gettingtogethernow.com
• juneb.bronamartin.org
• lurunufev.dishingitupgame.com
• wawod.studio-macs.com
• mipid.thetotalyousalon.com
• 69706681-db1b-4d35-b37e-a1e90d20c5f9.filesusr.com
• f84c539a-369d-47b7-be7a-11d7fe6e460a.filesusr.com
• 2a1ac6bc-9ba8-47bf-b85b-e76ecfa1254c.filesusr.com
• 060badb2-51c6-40fe-b811-b3ea9c6ce1e7.filesusr.com
• 5b9889b8-641d-4e0a-8500-1a159794b799.filesusr.com
• d5d5439d-371b-4963-98a3-33b21720f19c.filesusr.com
• ebcf3d5f-c138-473b-8ee8-f373a46117cc.filesusr.com
• 2f699457-4154-4af7-adb7-c8087d26bab3.filesusr.com
• 8e7b04f5-0934-4263-a770-f0648c000a04.filesusr.com
• 870c00f0-0a52-4f85-9df6-ec3e6b81b05f.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report