MALICIOUS — c638b7_eee76c35a3fa4a94a5b6e4b814c6e80f.pdf

MALICIOUS — c638b7_eee76c35a3fa4a94a5b6e4b814c6e80f.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: 4eddfcc27267ac901d1396939f4a8ee6760dfb50628c8562ac29a123dc99c3c3
• SHA-1: f2ff0e1f12e5028a8629adb08069ed92304d1a2e
• MD5: 7e66fc896dc327dd75cdd879fbe2a7c0
• ssdeep: 768:pgGzpD8MXjXzWBm0ZjZ3MvKn+hJ/ZtU1ROLjhTjR5q20zOnkqJwJxBG:KGFwaC9ZjZ3MS+L/ZC63h/Rd0zOnkoCe
• TLSH: T13232AEF354ABED4C3A83AF435DA611981045DB4D7223DB6449D97B6CC8BC2BDAF00A60
• Submitted as: c638b7_eee76c35a3fa4a94a5b6e4b814c6e80f.pdf
• File type: pdf · Size: 45468 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=plague+inc+evolved+apk+espa%25C3%25B1ol, https://cdn.shopify.com/s/files/1/0441/3505/5512/files/gogepejuvudiw.pdf, https://cdn.shopify.com/s/files/1/0461/9124/7511/files/zogikerewezorewaranum.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=plague+inc+evolved+apk+espa%25C3%25B1ol
• https://cdn.shopify.com/s/files/1/0441/3505/5512/files/gogepejuvudiw.pdf
• https://cdn.shopify.com/s/files/1/0461/9124/7511/files/zogikerewezorewaranum.pdf
• https://cdn.shopify.com/s/files/1/0432/1335/7214/files/muvaboxawowut.pdf
• http://files.heartshawaii.org/uploads/1/3/0/9/130969999/76a97d9e37c9f.pdf
• http://mutomovo.meruhouselekisilai.com/uploads/1/3/1/3/131384605/pagawumo-pugopimob.pdf
• http://files.foxwoodarabians.net/uploads/1/3/1/6/131637135/3bca9a7e6bcf6.pdf
• https://4c8162db-b4dc-4ad1-85e2-de07df613cd1.filesusr.com/ugd/5dc3ca_98e4ba27019b4aa18aac5779b48ccfa6.pdf?index=true
• https://db0b4134-109b-4e84-a543-86ab52a8585c.filesusr.com/ugd/8ff694_7acbdba5298542b5a4339fa6fc1feb00.pdf?index=true
• https://b3a60ff7-f9f7-406c-9896-f21049cde137.filesusr.com/ugd/9d66c7_b7a37ffd017a42f09f41fb6949150a32.pdf?index=true
• https://2479f9fb-abaf-42bb-a988-06811cb0a586.filesusr.com/ugd/268ab1_beae24834f3d410489c11aa119911f86.pdf?index=true
• https://5352dc09-38a7-4050-ad58-3dc4663637e5.filesusr.com/ugd/834936_846e5ec5e48542298baf385cadbba7c1.pdf?index=true
• https://aa0f88ef-c29a-48c1-a49c-8acc85419b0b.filesusr.com/ugd/7e0eb0_0b31d34404d54934b2d7cbefc0440519.pdf?index=true
• https://10e433b2-90e5-4f13-874a-a81835227b32.filesusr.com/ugd/05e3ad_44b40af7040446cd82c0103bb73694c9.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• cdn.shopify.com
• files.heartshawaii.org
• mutomovo.meruhouselekisilai.com
• files.foxwoodarabians.net
• 4c8162db-b4dc-4ad1-85e2-de07df613cd1.filesusr.com
• db0b4134-109b-4e84-a543-86ab52a8585c.filesusr.com
• b3a60ff7-f9f7-406c-9896-f21049cde137.filesusr.com
• 2479f9fb-abaf-42bb-a988-06811cb0a586.filesusr.com
• 5352dc09-38a7-4050-ad58-3dc4663637e5.filesusr.com
• aa0f88ef-c29a-48c1-a49c-8acc85419b0b.filesusr.com
• 10e433b2-90e5-4f13-874a-a81835227b32.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report