MALICIOUS — 5c8b2f_00946a23c228489f96f3e11c6948a2b6.pdf

MALICIOUS — 5c8b2f_00946a23c228489f96f3e11c6948a2b6.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

SHA-256: 548ea9b039d5fd265e6e71422d5c902c263340ae91f0b66212c3e9f1b8356eaf
SHA-1: 1679ab0cc73a80500de7a36dfa75b5a9fc431faa
MD5: 7f8b59697a05e64f272d1a082dc8f649
ssdeep: 768:rIgGzpD7XcH6Wd5meb6/I1fPFqrlOdk2e29oONGyhtVGfbvK1h56BwxU:BGF3Xcp96Mk2e2BN/2vrBwxU
TLSH: T1C72F8DF35057ECCC3A8BAB07AEBA00499042D3CD6136E6A045D9A77CD5BC6ED6E10631
Submitted as: 5c8b2f_00946a23c228489f96f3e11c6948a2b6.pdf
File type: pdf · Size: 35642 bytes
Verdict: malicious (88/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ttraff.cc/wix?keyword=screenwriter%2527s+bible+6th+edition+pdf, https://c2d1e017-9cdf-43fa-983f-150e7816e0d3.filesusr.com/ugd/1c8c1e_042ce58548474ac5a34428eab62e641d.pdf?index=true, https://74d09c20-1556-4c87-a95a-365fb206bc1f.filesusr.com/ugd/b0c717_9c1830e1f5cd4e738a1c3c2c97f1830b.pdf?index=true - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://ttraff.cc/wix?keyword=screenwriter%2527s+bible+6th+edition+pdf
https://c2d1e017-9cdf-43fa-983f-150e7816e0d3.filesusr.com/ugd/1c8c1e_042ce58548474ac5a34428eab62e641d.pdf?index=true
https://74d09c20-1556-4c87-a95a-365fb206bc1f.filesusr.com/ugd/b0c717_9c1830e1f5cd4e738a1c3c2c97f1830b.pdf?index=true
https://ae4cc920-e7b0-4b8a-8fc9-a8793744c792.filesusr.com/ugd/96564c_2a82c6ca48424b07ada407155d1d90e0.pdf?index=true
https://54f9f257-0f6d-4658-8734-21da9459970c.filesusr.com/ugd/3d0627_8e43c4210b0a4ffb8bb2ac8dd80b1e77.pdf?index=true
https://cdn.shopify.com/s/files/1/0429/2182/0319/files/21048281588.pdf
https://cdn.shopify.com/s/files/1/0431/5211/3820/files/brookland_cayce_high_school_graduation_2020.pdf
https://cdn.shopify.com/s/files/1/0437/9066/3832/files/ibm_cobol_manual.pdf
https://cdn.shopify.com/s/files/1/0439/3353/2315/files/juwuraxebasajaxej.pdf
http://walopame.southernstyledevents.com/uploads/1/3/2/7/132740405/d1a050f7f3b4.pdf
http://rifefal.walkaboutpouch.com/uploads/1/3/0/7/130739553/daguzav-vobufopelutaju.pdf
https://cdn.shopify.com/s/files/1/0436/1945/1043/files/que_es_metodo_canvas.pdf
https://cdn.shopify.com/s/files/1/0431/8697/8984/files/winimona.pdf
https://cdn.shopify.com/s/files/1/0435/5286/6463/files/database_management_system_mini_project_report.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ttraff.cc
c2d1e017-9cdf-43fa-983f-150e7816e0d3.filesusr.com
74d09c20-1556-4c87-a95a-365fb206bc1f.filesusr.com
ae4cc920-e7b0-4b8a-8fc9-a8793744c792.filesusr.com
54f9f257-0f6d-4658-8734-21da9459970c.filesusr.com
cdn.shopify.com
walopame.southernstyledevents.com
rifefal.walkaboutpouch.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report