MALICIOUS — 2d1648_766bf56d71284992a41ced4757085339.pdf

MALICIOUS — 2d1648_766bf56d71284992a41ced4757085339.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 4d16675550204f39e4a7ac6af8198276dde6ef12a664585fa697c87d49cb5c49
• SHA-1: 25d39f7763656e04272ec3703f67073ef176ead8
• MD5: 8ee8741537b2e6a81ab015d14f0f179a
• ssdeep: 768:cgGzpDAQ6sCVUFylgEZIxQpH4PURJI1bfFPZLB4OrgWGKfTfD5:5GF0dYJax4PURCzPZeOrgWGKbfD5
• TLSH: T1AF32AEF3519BDE887AC397536AA650856485C28C313297901199FB7CCCBCAFDBF40960
• Submitted as: 2d1648_766bf56d71284992a41ced4757085339.pdf
• File type: pdf · Size: 46947 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=propiedades+de+los+n%25C3%25BAmeros+reales, https://8744e9a4-be15-4c7a-b9cf-3232131bfbb9.filesusr.com/ugd/a4ea6c_842df4729d4447c4a3422bb1fca8d062.pdf?index=true, https://dd4a12e7-e251-4346-bcd2-42bca7fac032.filesusr.com/ugd/54fa57_fb796b47f638435bbbef43dc77c50bbe.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=propiedades+de+los+n%25C3%25BAmeros+reales
• https://8744e9a4-be15-4c7a-b9cf-3232131bfbb9.filesusr.com/ugd/a4ea6c_842df4729d4447c4a3422bb1fca8d062.pdf?index=true
• https://dd4a12e7-e251-4346-bcd2-42bca7fac032.filesusr.com/ugd/54fa57_fb796b47f638435bbbef43dc77c50bbe.pdf?index=true
• https://790df266-eb3b-4823-9488-c3f3a638ae53.filesusr.com/ugd/f4de5e_7bfa6b824e24428285884a7c3033799d.pdf?index=true
• http://files.empathtoorder.com/uploads/1/3/1/8/131857213/mesuko_zixevaki_zavilegupajugi_jevusabupam.pdf
• http://lowaras.all4ucustomcreations.com/uploads/1/3/1/0/131070450/9381269.pdf
• http://rawozeref.debbieyoung.co.uk/uploads/1/3/1/4/131406798/8193974.pdf
• http://files.nikkileahdesigns.com/uploads/1/3/0/7/130776141/zezovafu.pdf
• http://files.cheshirepool.net/uploads/1/3/1/6/131606968/8220962.pdf
• http://xononef.sundancecrow.com/uploads/1/3/1/4/131437299/35ca3339.pdf
• http://files.theflourishsisterhood.com/uploads/1/3/1/3/131398156/95d18288fa830.pdf
• https://58e38e6d-a848-4edb-9228-2e2653bbc892.filesusr.com/ugd/0c8cc8_3b446ee5d6094cf3adcb5f00148a8d93.pdf?index=true
• https://52a3dda3-1961-484f-a74e-80cc62af1375.filesusr.com/ugd/61567a_f481a89a001049d7b4ec91c7b817019d.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• 8744e9a4-be15-4c7a-b9cf-3232131bfbb9.filesusr.com
• dd4a12e7-e251-4346-bcd2-42bca7fac032.filesusr.com
• 790df266-eb3b-4823-9488-c3f3a638ae53.filesusr.com
• files.empathtoorder.com
• lowaras.all4ucustomcreations.com
• rawozeref.debbieyoung.co.uk
• files.nikkileahdesigns.com
• files.cheshirepool.net
• xononef.sundancecrow.com
• files.theflourishsisterhood.com
• 58e38e6d-a848-4edb-9228-2e2653bbc892.filesusr.com
• 52a3dda3-1961-484f-a74e-80cc62af1375.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report