MALICIOUS — ca847e_ab75ffb6cb11491b9efe0c8753f1513c.pdf

MALICIOUS — ca847e_ab75ffb6cb11491b9efe0c8753f1513c.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 53b3a1e3b1ddd2e6534f818722adfcce873c5a59de23c96a08e9641ed45689c3
• SHA-1: fd25381f9e2e7ae633a962525628b2d999a428fa
• MD5: f0c56799f411c7f1856ddeaade2651d9
• ssdeep: 768:ugGzpD2AAGOD1qmme2Dl7nm11WvXPrFnzzNfzON3no0GPFLQIlfB3YY:LGFKiJnm1Uv/r5h83o0GP+cfdYY
• TLSH: T1AB319EF31097ED4C3A8A6B477EFB116D6086C78D6026A360498E772CD07C6FE6E00A54
• Submitted as: ca847e_ab75ffb6cb11491b9efe0c8753f1513c.pdf
• File type: pdf · Size: 40981 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=destiny+2+escalation+protocol+key, https://405a454a-892b-48b4-8a44-ee5b4573318e.filesusr.com/ugd/bba345_c9716754f9694abbbd15e0c058a7d479.pdf?index=true, https://9497311f-621c-405b-9dc7-13ba3c954ede.filesusr.com/ugd/8acad3_66a764958c504fa9a773c98eb5ae1cab.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=destiny+2+escalation+protocol+key
• https://405a454a-892b-48b4-8a44-ee5b4573318e.filesusr.com/ugd/bba345_c9716754f9694abbbd15e0c058a7d479.pdf?index=true
• https://9497311f-621c-405b-9dc7-13ba3c954ede.filesusr.com/ugd/8acad3_66a764958c504fa9a773c98eb5ae1cab.pdf?index=true
• https://c8fbccee-eb0d-48f7-8803-1b3fd3406348.filesusr.com/ugd/565485_5c3bc1dd35e04de8a109a1218113982e.pdf?index=true
• https://e2012bb3-69e5-46af-8b96-2f18709e5d05.filesusr.com/ugd/f09a9d_537087a1e91b4ed7b4c207ee4f2c394a.pdf?index=true
• https://a30bab4e-3fda-446e-807b-342b6d5309b8.filesusr.com/ugd/227d0f_ebec65cf3240426ca05d7e83562c7881.pdf?index=true
• http://files.schoonerberries.com/uploads/1/3/1/4/131410012/3887831.pdf
• http://files.appletonepiscopal.org/uploads/1/3/0/8/130813777/5247092.pdf
• http://files.cvgc1991.org/uploads/1/3/1/4/131452870/9fbaa1731dca3eb.pdf
• http://xuboni.kyocreations.com/uploads/1/3/1/6/131606177/fatukisafi.pdf
• http://files.cothamsinthecity.com/uploads/1/3/1/3/131380564/lomigemomopid-vokovajaxolurez-parov-mijekipap.pdf
• https://cdn.shopify.com/s/files/1/0430/3159/3113/files/17050656007.pdf
• https://cdn.shopify.com/s/files/1/0431/5077/0342/files/formule_pour_calculer_taxes_excel.pdf
• https://cdn.shopify.com/s/files/1/0463/0321/5778/files/datisufi.pdf
• https://cdn.shopify.com/s/files/1/0433/9266/3702/files/income_tax_amendments_for_ipcc_may_2020.pdf
• https://cdn.shopify.com/s/files/1/0434/7009/4501/files/pubg_mobile_controller_android_ebay.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• 405a454a-892b-48b4-8a44-ee5b4573318e.filesusr.com
• 9497311f-621c-405b-9dc7-13ba3c954ede.filesusr.com
• c8fbccee-eb0d-48f7-8803-1b3fd3406348.filesusr.com
• e2012bb3-69e5-46af-8b96-2f18709e5d05.filesusr.com
• a30bab4e-3fda-446e-807b-342b6d5309b8.filesusr.com
• files.schoonerberries.com
• files.appletonepiscopal.org
• files.cvgc1991.org
• xuboni.kyocreations.com
• files.cothamsinthecity.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report