MALICIOUS — 2813e2_be26c7cc29c3482c91da90fafe1028c2.pdf

MALICIOUS — 2813e2_be26c7cc29c3482c91da90fafe1028c2.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 4e9b24ccfa11a5fbfefb5bce3d4713654ed8633d25db90b07db4c566bc8c5556
• SHA-1: 75e23491eb698667d782443b40b2cb9610cf34f6
• MD5: 44ecd604a1af4817980ab2aa2d6b1fe4
• ssdeep: 768:kgGzpDxrRlccmQvxU2mYG8vkrb58eKnUat5S/X2lfeq/JjXG1q3:RGFFVxm2MrWnnj5O2ReqF21q3
• TLSH: T12531AEF750A3EE482ECB1B43AD9A04A97486DB886136D6B051C9773CC4B86FC6F40D61
• Submitted as: 2813e2_be26c7cc29c3482c91da90fafe1028c2.pdf
• File type: pdf · Size: 42465 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=vegetables+unleashed+pdf, https://cdn.shopify.com/s/files/1/0433/5874/8837/files/nakapirogil.pdf, https://cdn.shopify.com/s/files/1/0432/6175/5547/files/24336159755.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=vegetables+unleashed+pdf
• https://cdn.shopify.com/s/files/1/0433/5874/8837/files/nakapirogil.pdf
• https://cdn.shopify.com/s/files/1/0432/6175/5547/files/24336159755.pdf
• https://cdn.shopify.com/s/files/1/0434/6501/5446/files/papetagoxejewixegegata.pdf
• https://cdn.shopify.com/s/files/1/0435/5253/8773/files/abhinetri_2_movie_telugu.pdf
• https://cdn.shopify.com/s/files/1/0432/3383/7219/files/86763782573.pdf
• http://foputesur.lojyouth.com/uploads/1/3/0/8/130874523/75569fccd9d.pdf
• https://12839eed-907b-4bf1-88ba-dd8ea023d9f5.filesusr.com/ugd/93c935_685c07658f634c5b831855d88c3f45d6.pdf?index=true
• https://9fdaf96f-9d23-440e-9e39-b04b540d41fc.filesusr.com/ugd/834936_288187f7ed0544c8a57e151898c12c75.pdf?index=true
• https://6d1725da-3258-49e9-9ede-4c5aeceb04fd.filesusr.com/ugd/4fb05f_83f0ef43bb6e4ef3be79daf85b8c95ef.pdf?index=true
• https://888ede41-b781-4bdd-bc6c-fa9b515405a8.filesusr.com/ugd/93c935_8803101d0be144ddb70491a0f38715c1.pdf?index=true
• https://3f95a01a-7859-4c3a-9ae3-c4184fdccff6.filesusr.com/ugd/3f80ec_eb0e53e6b5ee47d8acaf965b73405883.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• cdn.shopify.com
• foputesur.lojyouth.com
• 12839eed-907b-4bf1-88ba-dd8ea023d9f5.filesusr.com
• 9fdaf96f-9d23-440e-9e39-b04b540d41fc.filesusr.com
• 6d1725da-3258-49e9-9ede-4c5aeceb04fd.filesusr.com
• 888ede41-b781-4bdd-bc6c-fa9b515405a8.filesusr.com
• 3f95a01a-7859-4c3a-9ae3-c4184fdccff6.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report