MALICIOUS — 24d943_d3254cd9ce4d4d53b04c88d0407d34e6.pdf

MALICIOUS — 24d943_d3254cd9ce4d4d53b04c88d0407d34e6.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 39d6b226c14c20d72cc64681574781ac7d6f1620885160ada0dea10c2f456ce1
• SHA-1: 3faeea46e04e262e32a5f983e14475f88fce41cf
• MD5: 81857a0e08643499c40df68e59fb4a36
• ssdeep: 768:vgGzpD6O7Pmx5Fiii62/RbZqDNRag2GxRMXWnPAKmH4tvi6dqaZ8tIF1r7Msf:YGF/IniX9SQLiRgPKmHmi6d7/Hr7Msf
• TLSH: T16333DFF390A7ED4C699A5B03EDE621656085E38DA136E7246D5D3A3CC47C2FDAE40830
• Submitted as: 24d943_d3254cd9ce4d4d53b04c88d0407d34e6.pdf
• File type: pdf · Size: 51461 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.PDF.Agent.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.PDF.Agent.gen (rule HEUR:Trojan.PDF.Agent.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=sega+emulator+apk, https://efcc13d5-fa24-4ef5-87e6-8174401c9ec9.filesusr.com/ugd/b1b3ad_932c6200b7c242249136abb5a0685e9d.pdf?index=true, https://75c5a66a-7e4b-4bb8-8182-a4ffd1a007f9.filesusr.com/ugd/e643da_c96525df21a64d67b50aa3ac568bb447.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=sega+emulator+apk
• https://efcc13d5-fa24-4ef5-87e6-8174401c9ec9.filesusr.com/ugd/b1b3ad_932c6200b7c242249136abb5a0685e9d.pdf?index=true
• https://75c5a66a-7e4b-4bb8-8182-a4ffd1a007f9.filesusr.com/ugd/e643da_c96525df21a64d67b50aa3ac568bb447.pdf?index=true
• https://794a9aa5-3782-4b2c-80f4-63db899ee980.filesusr.com/ugd/bb05c1_4d5ab0705de241bc8bdd454360818483.pdf?index=true
• https://e29ded64-38f5-4eed-a212-40e172c18d8d.filesusr.com/ugd/b148e5_4e6d895f2924432d8834055be864143f.pdf?index=true
• https://89c8f6cc-c674-4952-953a-c151319104ec.filesusr.com/ugd/668a47_71dd9d2cecee4c3a83d058493e9cc6b6.pdf?index=true
• https://0e189583-5226-4ffa-a482-9de8876bff1a.filesusr.com/ugd/69695d_99ccf1a22631453aa75eff0eb06e4f78.pdf?index=true
• https://f9fe4c64-c7f3-4371-b764-56b848428cbe.filesusr.com/ugd/3e87bf_743c36e6f7204304bde929c1a0221e52.pdf?index=true
• https://a4091b5e-1a6c-4620-8b72-9fbe9528149b.filesusr.com/ugd/4329d7_ad1b29f1829446608f8dd35787859c94.pdf?index=true
• https://9852b447-aeb1-4bda-aef4-7be8e18f64dc.filesusr.com/ugd/b65acf_aa10f2ac59bf4f71bb73957f4bd146be.pdf?index=true
• https://cdn.shopify.com/s/files/1/0428/9835/8432/files/dojezurin.pdf
• https://cdn.shopify.com/s/files/1/0435/8068/6495/files/berapusifevekemuwaki.pdf
• https://d2d917d8-b052-4c79-b688-88c0a8bb1b64.filesusr.com/ugd/e4f6f0_b1b072dfb7e0419da1513b3dc8471b44.pdf?index=true
• https://10ca1b36-379f-404a-9482-ae1fb0ab465d.filesusr.com/ugd/33ab24_026c5235e40946d5acb00829ccabedb5.pdf?index=true
• https://0bf84bb6-0163-44a1-8a52-d73af18efcba.filesusr.com/ugd/80fd5d_c41e28181db64a6989218d2c8b5f6fa6.pdf?index=true
• https://f6e271a7-826b-4c4b-887e-ca91a12a2de2.filesusr.com/ugd/2f7815_2e66d8bd5d084060bb7c30ec9ab9e2a4.pdf?index=true
• https://b7800144-0047-4eb7-95f1-2dc2cab3e4f1.filesusr.com/ugd/c638b7_f405d437d6ad4006bb6a76ccaa0e81ee.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• efcc13d5-fa24-4ef5-87e6-8174401c9ec9.filesusr.com
• 75c5a66a-7e4b-4bb8-8182-a4ffd1a007f9.filesusr.com
• 794a9aa5-3782-4b2c-80f4-63db899ee980.filesusr.com
• e29ded64-38f5-4eed-a212-40e172c18d8d.filesusr.com
• 89c8f6cc-c674-4952-953a-c151319104ec.filesusr.com
• 0e189583-5226-4ffa-a482-9de8876bff1a.filesusr.com
• f9fe4c64-c7f3-4371-b764-56b848428cbe.filesusr.com
• a4091b5e-1a6c-4620-8b72-9fbe9528149b.filesusr.com
• 9852b447-aeb1-4bda-aef4-7be8e18f64dc.filesusr.com
• cdn.shopify.com
• d2d917d8-b052-4c79-b688-88c0a8bb1b64.filesusr.com
• 10ca1b36-379f-404a-9482-ae1fb0ab465d.filesusr.com
• 0bf84bb6-0163-44a1-8a52-d73af18efcba.filesusr.com
• f6e271a7-826b-4c4b-887e-ca91a12a2de2.filesusr.com
• b7800144-0047-4eb7-95f1-2dc2cab3e4f1.filesusr.com
• hb.tv
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report