MALICIOUS — bdc04d_b27e1a2cf8f1443db6d04ab3d59fb79b.pdf

MALICIOUS — bdc04d_b27e1a2cf8f1443db6d04ab3d59fb79b.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

SHA-256: 3ec372bfccf45187b1854246465ca9f5cb594cabf41f59836dda4b07e37a752a
SHA-1: 2538ecdbc75d542c109642f51ecfeea3687934a6
MD5: ac4a8ff8899a30a3ec01e9bc7a2f1411
ssdeep: 768:ggGzpDXe2vNoOWd8a0rKiSzaQ0/q57yMV/V5Cf7QEA1s0R+MyY3LPK:tGFrvoiSzaf62qW0R+A3LPK
TLSH: T12332AEF300A7EDCC3B8B9B576DAA1549A146D78C3132A76084D9372CC97C5ECAF10626
Submitted as: bdc04d_b27e1a2cf8f1443db6d04ab3d59fb79b.pdf
File type: pdf · Size: 47091 bytes
Verdict: malicious (88/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ttraff.me/wix?keyword=indiana+jones+satchel+strap, http://files.francisbongiovannilaw.com/uploads/1/3/1/4/131483154/voloramekaxoruton.pdf, http://files.whiaapi2012sesummit.com/uploads/1/3/2/7/132712514/11979c9b970a.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://ttraff.me/wix?keyword=indiana+jones+satchel+strap
http://files.francisbongiovannilaw.com/uploads/1/3/1/4/131483154/voloramekaxoruton.pdf
http://files.whiaapi2012sesummit.com/uploads/1/3/2/7/132712514/11979c9b970a.pdf
http://files.colintrusedell.com/uploads/1/3/1/4/131438843/mitumegogemeb-temovupomujus.pdf
https://cdn.shopify.com/s/files/1/0429/0124/2015/files/yeh_bhagwa_rang_dj_song_pagalworld.pdf
https://cdn.shopify.com/s/files/1/0461/9373/7886/files/96662220891.pdf
https://cdn.shopify.com/s/files/1/0431/4365/9677/files/63647976652.pdf
https://cdn.shopify.com/s/files/1/0436/5382/4677/files/38951582638.pdf
http://files.msmbnyc.com/uploads/1/3/1/4/131437044/c66531db074.pdf
http://files.beatawiggen.com/uploads/1/3/1/6/131636890/1466086.pdf
http://files.tyrmalinoisaustralia.com/uploads/1/3/1/6/131636972/178813.pdf
http://files.porthuronchurchofchrist.org/uploads/1/3/1/0/131070313/cb32fe472.pdf
https://b9f6d6ea-08d6-42b5-bb35-74d01027d5e4.filesusr.com/ugd/735189_26e29753bd3e497fa55fa9031ec7a18d.pdf?index=true
https://ed57ea53-8555-4c99-beec-1e11fc06571b.filesusr.com/ugd/2f3ac6_2a4d14f52ee74e069d2cfb2bc2e03de0.pdf?index=true
https://eddb93c7-decc-455a-bb11-c947a5bbbc6f.filesusr.com/ugd/b926a8_f48eabe488d340ed85090e67229bca1d.pdf?index=true
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ttraff.me
files.francisbongiovannilaw.com
files.whiaapi2012sesummit.com
files.colintrusedell.com
cdn.shopify.com
files.msmbnyc.com
files.beatawiggen.com
files.tyrmalinoisaustralia.com
files.porthuronchurchofchrist.org
b9f6d6ea-08d6-42b5-bb35-74d01027d5e4.filesusr.com
ed57ea53-8555-4c99-beec-1e11fc06571b.filesusr.com
eddb93c7-decc-455a-bb11-c947a5bbbc6f.filesusr.com
www.w3.org
purl.org
ns.adobe.com

File paths

y:\VX

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report