MALICIOUS — ab922d_9ec3c6586c8847c892092cbfd4f17232.pdf

MALICIOUS — ab922d_9ec3c6586c8847c892092cbfd4f17232.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 670a4bcce412d5f346bc6284619865338082bb32cb802e9ae8a9e4b9373122ea
• SHA-1: 9afa2b6623a8911775c627f4831a9a70aea1b7df
• MD5: e79a10b4444670c23eacfd6192397b0f
• ssdeep: 768:VgGzpDz0sYTngPsj7GI7eYI7NP7VyyetQCbtwoYLf:GGFne72p7VyHtjWoYLf
• TLSH: T194309FF31067ECCC7A8B5B07EAA71459A145DA8D2037D67018E87A6CC4BC3FE2E10665
• Submitted as: ab922d_9ec3c6586c8847c892092cbfd4f17232.pdf
• File type: pdf · Size: 38291 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=lego+software+engineer+salary, https://cdn.shopify.com/s/files/1/0433/0687/7080/files/70745323757.pdf, https://cdn.shopify.com/s/files/1/0429/9902/1717/files/20197794688.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=lego+software+engineer+salary
• https://cdn.shopify.com/s/files/1/0433/0687/7080/files/70745323757.pdf
• https://cdn.shopify.com/s/files/1/0429/9902/1717/files/20197794688.pdf
• https://cdn.shopify.com/s/files/1/0430/6350/9143/files/53029712864.pdf
• http://fijavedo.voiceofgodrevivalsministrie.org/uploads/1/3/1/3/131383478/2294a1c8c18043.pdf
• http://files.themilcgroup.com/uploads/1/3/1/4/131406717/7f77f22.pdf
• http://files.esprit-de-core.com/uploads/1/3/1/6/131606201/5181262.pdf
• http://lisegadi.arifails.com/uploads/1/3/0/7/130740178/3135582.pdf
• https://23c909fe-5b09-4045-8fb1-f7faf61c3969.filesusr.com/ugd/86319b_f394c57910734deeb5f02e414eb8b015.pdf?index=true
• https://d6326a48-fdb5-4244-80d7-91285a12c3ce.filesusr.com/ugd/592671_06cc13854d544b1daa6ade77f21e4880.pdf?index=true
• https://89640d79-91b6-4b6a-a551-6b1a4560787d.filesusr.com/ugd/a4c1fa_5a44d5e0cd124d8eb00ae52e442701d1.pdf?index=true
• https://89a48184-b8c8-4c5e-b650-3a1aab2f352a.filesusr.com/ugd/8c0e65_1556849df3534b9485cde16337d4da19.pdf?index=true
• https://a75addd4-7144-43d4-ab13-220009ca61e0.filesusr.com/ugd/510a18_f07b387c2fa147b49dfaef16d3dbbced.pdf?index=true
• https://eb09ab77-c827-4699-8d04-0e233989154d.filesusr.com/ugd/73c254_f0aa794a68af4864a731ff3c3b6c6f8c.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• cdn.shopify.com
• fijavedo.voiceofgodrevivalsministrie.org
• files.themilcgroup.com
• files.esprit-de-core.com
• lisegadi.arifails.com
• 23c909fe-5b09-4045-8fb1-f7faf61c3969.filesusr.com
• d6326a48-fdb5-4244-80d7-91285a12c3ce.filesusr.com
• 89640d79-91b6-4b6a-a551-6b1a4560787d.filesusr.com
• 89a48184-b8c8-4c5e-b650-3a1aab2f352a.filesusr.com
• a75addd4-7144-43d4-ab13-220009ca61e0.filesusr.com
• eb09ab77-c827-4699-8d04-0e233989154d.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report