MALICIOUS — 49be48_8dab952e02144a019255ffa90c2bea78.pdf

MALICIOUS — 49be48_8dab952e02144a019255ffa90c2bea78.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: 68c881705dbdc9fda002743569272407505630715b4ca5602bb0b37072776c36
• SHA-1: e61afcade466a31b3edc631271fd3def19a0138d
• MD5: 0013776e40afe1aa3f1bb445c4c66e3b
• ssdeep: 768:ugGzpDKkBrzvUE0pFpbj0l2tsq9zil4Jz6cpgH8kM/rn8Rky:LGFGkzarbjlp3rn8Rky
• TLSH: T14F328EF364A7FC8C2E5A6B039CF7119A515AC3896126A76455CC3B2CC87C5BC6E41870
• Submitted as: 49be48_8dab952e02144a019255ffa90c2bea78.pdf
• File type: pdf · Size: 44177 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=caliber+loan+modification+application, http://files.ianthompsonceramics.com/uploads/1/3/0/8/130874067/0c71723ae4953.pdf, http://files.guillome.nl/uploads/1/3/2/6/132696512/472ae.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=caliber+loan+modification+application
• http://files.ianthompsonceramics.com/uploads/1/3/0/8/130874067/0c71723ae4953.pdf
• http://files.guillome.nl/uploads/1/3/2/6/132696512/472ae.pdf
• http://files.lcmadesign.com/uploads/1/3/1/4/131406744/gawenalisegak.pdf
• http://bumoxop.greendrakeoutdoors.com/uploads/1/3/1/6/131637517/4227420.pdf
• https://af78ddec-312f-4416-a866-d4a39ba5b71c.filesusr.com/ugd/0511f5_1a4b34f710cd412796e3eebadb8e905d.pdf?index=true
• https://ab2c6e00-ef30-4f04-8a33-79f0a9e38e9e.filesusr.com/ugd/4c1554_7ef394a7b2544a2aa9157d2c63ed64f8.pdf?index=true
• https://5807444f-183d-4c21-b57f-b741411f4489.filesusr.com/ugd/ab922d_9ec3c6586c8847c892092cbfd4f17232.pdf?index=true
• https://ab4f4cc9-1652-49f9-8c4c-1c1020a48bb8.filesusr.com/ugd/229b11_5a603eec792144efbcfa4b253c5200c5.pdf?index=true
• http://files.adrianeejones.com/uploads/1/3/1/6/131607075/zuxana.pdf
• http://files.drmarysabal.com/uploads/1/3/1/3/131380558/1104339.pdf
• http://files.dougsheat.com/uploads/1/3/0/9/130969576/8469915.pdf
• http://files.johntherev.com/uploads/1/3/0/7/130738914/2442753.pdf
• http://files.aimeehillmassageyoga.co.uk/uploads/1/3/0/7/130738701/001457ae44.pdf
• https://cdn.shopify.com/s/files/1/0431/6397/5835/files/fable_3_silver_keys.pdf
• https://cdn.shopify.com/s/files/1/0432/3000/3357/files/71131355500.pdf
• https://cdn.shopify.com/s/files/1/0432/5166/3012/files/1114597561.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• files.ianthompsonceramics.com
• files.guillome.nl
• files.lcmadesign.com
• bumoxop.greendrakeoutdoors.com
• af78ddec-312f-4416-a866-d4a39ba5b71c.filesusr.com
• ab2c6e00-ef30-4f04-8a33-79f0a9e38e9e.filesusr.com
• 5807444f-183d-4c21-b57f-b741411f4489.filesusr.com
• ab4f4cc9-1652-49f9-8c4c-1c1020a48bb8.filesusr.com
• files.adrianeejones.com
• files.drmarysabal.com
• files.dougsheat.com
• files.johntherev.com
• files.aimeehillmassageyoga.co.uk
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report