MALICIOUS — 89441e_5a2c9431c2fa498398327dc3e487d64b.pdf

MALICIOUS — 89441e_5a2c9431c2fa498398327dc3e487d64b.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 54 detection engines flagged it.

Identification

• SHA-256: 679065d33b3073aede408965ddfe56fcd0785ec1e9f31d894c54f6bd9b9ca57b
• SHA-1: b30e26dccc55282a99490bf46de4f4f2cd756258
• MD5: 1da2a1c099afba052d2dbf317d3e4d1e
• ssdeep: 768:DgGzpDij5oNsb/SA+FJCrbX4uHzlHPE7LcbSRCyu1t2w1rWNHR8HP1q:8GFW+qb/MsSRW1t2KOHRENq
• TLSH: T1F5329EF3249BEC8C368B9B03EDB715557485C6487133ABA5048CBB2CC8BC5BDAE50920
• Submitted as: 89441e_5a2c9431c2fa498398327dc3e487d64b.pdf
• File type: pdf · Size: 44706 bytes
• Verdict: malicious (94/100)

Detections (4 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: Trojan:PDF/Phish!atmn
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 94/100 is the fusion of 7 weighted signals:

• Microsoft Defender flagged Trojan:PDF/Phish!atmn (rule Trojan:PDF/Phish!atmn) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=shito+ryu+vs+shotokan, http://teluxi.holistichealingandbeing.com/uploads/1/3/1/3/131380767/rekajajakaxad-tisetar-samasuvun.pdf, http://files.pansqip.org/uploads/1/3/0/9/130969984/1811080.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=shito+ryu+vs+shotokan
• http://teluxi.holistichealingandbeing.com/uploads/1/3/1/3/131380767/rekajajakaxad-tisetar-samasuvun.pdf
• http://files.pansqip.org/uploads/1/3/0/9/130969984/1811080.pdf
• http://dudiriga.mytempowalk.com/uploads/1/3/0/9/130969317/5043206.pdf
• http://files.hubmiller.com/uploads/1/3/2/6/132681460/xiwufat.pdf
• http://files.judyireneharney.com/uploads/1/3/2/8/132814518/e73b3f.pdf
• https://cdn.shopify.com/s/files/1/0482/9721/4110/files/lotus_flower_tattoo_template.pdf
• https://cdn.shopify.com/s/files/1/0432/0375/6196/files/apk_clash_royale_hack_version.pdf
• https://0d8cee7c-81c4-45f8-84b0-325fdb8db50f.filesusr.com/ugd/e32576_17f5505c548d4764bd6f985f488aec87.pdf?index=true
• https://29d70d04-6939-4520-a6f3-d7d531dc1ac5.filesusr.com/ugd/681527_a3f95d2270d34e43bd7cbfbb9dca7223.pdf?index=true
• https://69e33b28-f14f-48e9-981e-34c39c364cd5.filesusr.com/ugd/6f53d7_ab2907eb47f24c5f84868c9c97aa2432.pdf?index=true
• https://374a1674-7423-44c4-b07e-2db193f3afa3.filesusr.com/ugd/e80f4c_4f916d88ceb943c2bfa971cba9fa6a22.pdf?index=true
• https://554dc969-b4bb-4999-b6e8-b52c03678555.filesusr.com/ugd/65e777_272febf9db09490fae5d1fc2aeb1fc1d.pdf?index=true
• https://cdn.shopify.com/s/files/1/0431/6535/2093/files/55538580944.pdf
• https://cdn.shopify.com/s/files/1/0438/2097/4242/files/attendance_allowance_forms_special_rules.pdf
• https://cdn.shopify.com/s/files/1/0433/5868/3291/files/19942576654.pdf
• https://cdn.shopify.com/s/files/1/0438/0885/0081/files/26799207784.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• teluxi.holistichealingandbeing.com
• files.pansqip.org
• dudiriga.mytempowalk.com
• files.hubmiller.com
• files.judyireneharney.com
• cdn.shopify.com
• 0d8cee7c-81c4-45f8-84b0-325fdb8db50f.filesusr.com
• 29d70d04-6939-4520-a6f3-d7d531dc1ac5.filesusr.com
• 69e33b28-f14f-48e9-981e-34c39c364cd5.filesusr.com
• 374a1674-7423-44c4-b07e-2db193f3afa3.filesusr.com
• 554dc969-b4bb-4999-b6e8-b52c03678555.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report