MALICIOUS — cb2bed_9f82c92d734a4d0d8ae76b2a2481647e.pdf

MALICIOUS — cb2bed_9f82c92d734a4d0d8ae76b2a2481647e.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: 4c303376b2b4aa9b9658f90f8bb4f0b3cb59177ede3bee4d7eb494e730b42d04
• SHA-1: 2cce97854468d79c98259fb8a91dab4205914557
• MD5: e9c213b09d46503782f332dedbecac0f
• ssdeep: 1536:RGFGcfsSEVaW7pP4NG40AZrP4fqvC3RDBu4Hesw5T6:0FGcacW7uNBZcyvC3FU4HdwQ
• TLSH: T17837DFF72093EC4D798BDB03BDA9285DC589DA8CA0639374598C2B6DC0386BD7F40952
• Submitted as: cb2bed_9f82c92d734a4d0d8ae76b2a2481647e.pdf
• File type: pdf · Size: 73968 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=paul+reinhold+jobs+net+worth, https://cdn.shopify.com/s/files/1/0433/5940/4197/files/59634141853.pdf, https://cdn.shopify.com/s/files/1/0486/9937/5766/files/elements_from_stardust_worksheet_answers.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=paul+reinhold+jobs+net+worth
• https://cdn.shopify.com/s/files/1/0433/5940/4197/files/59634141853.pdf
• https://cdn.shopify.com/s/files/1/0486/9937/5766/files/elements_from_stardust_worksheet_answers.pdf
• https://cdn.shopify.com/s/files/1/0431/3566/4284/files/audi_a3_cabriolet_2014_manual.pdf
• https://cdn.shopify.com/s/files/1/0437/1644/4311/files/36228282772.pdf
• https://cdn.shopify.com/s/files/1/0436/0273/9362/files/serar.pdf
• https://cdn.shopify.com/s/files/1/0435/8946/8328/files/residential_network_cabling.pdf
• https://cdn.shopify.com/s/files/1/0431/6761/3087/files/gasonamudi.pdf
• http://files.veteransmusicfest.org/uploads/1/3/1/6/131636682/ronop.pdf
• http://mitesu.upcyclemom.net/uploads/1/3/0/7/130739919/zenemoruridesuzuwog.pdf
• http://files.mosaicdownsyndrome.com/uploads/1/3/1/4/131453436/e53d23f7a.pdf
• https://cdn.shopify.com/s/files/1/0437/6884/0341/files/jakabixesuveneket.pdf
• https://cdn.shopify.com/s/files/1/0457/0805/0588/files/daphnia_life_span.pdf
• https://cdn.shopify.com/s/files/1/0435/5692/9687/files/aditya_birla_mutual_fund_nominee_updation_form.pdf
• https://cdn.shopify.com/s/files/1/0431/5371/9452/files/filomegepel.pdf
• https://cdn.shopify.com/s/files/1/0428/3134/7868/files/clorox_urine_remover_sds_sheet.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• cdn.shopify.com
• files.veteransmusicfest.org
• mitesu.upcyclemom.net
• files.mosaicdownsyndrome.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report