MALICIOUS — 7a359d_8c7a2900a8cd4d829d0b76443b6697d3.pdf

MALICIOUS — 7a359d_8c7a2900a8cd4d829d0b76443b6697d3.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: 32a1363d151feacf71b81a86a4eb90249aa25dcbe93fa5f955a64bb9e457fb17
• SHA-1: cd8d490de7ee0c15aed17bd649b52a5ded9dd9c9
• MD5: 043103772675b1f17c8862b036441724
• ssdeep: 768:1gGzpDRQlbSpykNU6cfDPPuGUfKdBuDUC1p+MrtLoLW8yXkdMniWlGYTKFOomkWg:mGFN0zPuHCPC/lrtLoLW8hdMniWlGrOE
• TLSH: T19A33AEF300EBECCD7687AB076E6600606989C7856137EAA504987B7CD87C1BE7E00D61
• Submitted as: 7a359d_8c7a2900a8cd4d829d0b76443b6697d3.pdf
• File type: pdf · Size: 48867 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=love+island+the+game+mod+apk+download, https://cdn.shopify.com/s/files/1/0433/4295/4650/files/24145587257.pdf, https://cdn.shopify.com/s/files/1/0431/9520/3745/files/nisuvimirupejowud.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=love+island+the+game+mod+apk+download
• https://cdn.shopify.com/s/files/1/0433/4295/4650/files/24145587257.pdf
• https://cdn.shopify.com/s/files/1/0431/9520/3745/files/nisuvimirupejowud.pdf
• https://cdn.shopify.com/s/files/1/0437/4547/6762/files/bixujapotosozevavig.pdf
• https://cdn.shopify.com/s/files/1/0428/9835/8432/files/zosakasebiribo.pdf
• https://cdn.shopify.com/s/files/1/0461/7584/6554/files/pogiwekot.pdf
• https://cdn.shopify.com/s/files/1/0433/9862/7495/files/local_web_servers.pdf
• https://cdn.shopify.com/s/files/1/0433/0687/7080/files/xawifakupubegezixezo.pdf
• https://cdn.shopify.com/s/files/1/0428/9835/8432/files/31052941417.pdf
• http://vexelo.clevelandresearchcareers.com/uploads/1/3/1/0/131070381/silapos.pdf
• http://sogape.patriciajosephine.com/uploads/1/3/1/1/131164462/damabudifexu_nididax_pigel_luguzutol.pdf
• http://lijiza.monarteonline.com/uploads/1/3/1/4/131438580/fikelafebotomaso.pdf
• http://files.thomasmadden.org/uploads/1/3/1/4/131437813/berigaw.pdf
• http://files.neeleyandneeley.com/uploads/1/3/0/9/130968956/vesubim.pdf
• https://1572985b-717a-4ff6-8046-bdcd98c00e49.filesusr.com/ugd/0e6328_70b1e8148eb1446db3caed6313247eb3.pdf?index=true
• https://901edb6a-387b-4860-9de6-2c5691b27c16.filesusr.com/ugd/682d1c_9dec447de15e461eafae2055da9e942c.pdf?index=true
• https://18b80cb8-a74b-4618-b980-64a85035b85e.filesusr.com/ugd/45fd81_6fd6c50514a1441b98886d19b8a367db.pdf?index=true
• https://97b50298-b0ca-4968-bc70-c0c23b3101a3.filesusr.com/ugd/0ebc1f_9f3c6f503b6a4b048375418be80232b3.pdf?index=true
• https://e6719c83-49ab-4fca-866e-beebda37fd85.filesusr.com/ugd/0994f9_778f25385219413cb0271634b3b98647.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• cdn.shopify.com
• vexelo.clevelandresearchcareers.com
• sogape.patriciajosephine.com
• lijiza.monarteonline.com
• files.thomasmadden.org
• files.neeleyandneeley.com
• 1572985b-717a-4ff6-8046-bdcd98c00e49.filesusr.com
• 901edb6a-387b-4860-9de6-2c5691b27c16.filesusr.com
• 18b80cb8-a74b-4618-b980-64a85035b85e.filesusr.com
• 97b50298-b0ca-4968-bc70-c0c23b3101a3.filesusr.com
• e6719c83-49ab-4fca-866e-beebda37fd85.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report