MALICIOUS — f3ecbe_ea46a6880d9b4d47ad385f3e989a23c9.pdf

MALICIOUS — f3ecbe_ea46a6880d9b4d47ad385f3e989a23c9.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: 6c8a4cf900cd14c77a961787c1b8750bb4751112f2d812beae3e44d5294f1b78
• SHA-1: 4c179a33f2000fa17337eb65c74909666e6b20a1
• MD5: b82d52078d858e45b16fa1b67a66316f
• ssdeep: 1536:8GFIN9+GmqxRr5uKjhc2Ft8T7Ui/llIDplWlD5+QV/EdtYH3:ZFIN9+GX/h6+OUKnItwD9G34
• TLSH: T10B35BFF351ABED4CB68EAF03AEA61459704696C83123E27859CD3B6CC43C2BD6E41950
• Submitted as: f3ecbe_ea46a6880d9b4d47ad385f3e989a23c9.pdf
• File type: pdf · Size: 61863 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=tafsir+al+ahlam+mktbtk, https://be2467e7-f3a6-4236-a57c-0a2288ec77d2.filesusr.com/ugd/1d64af_bd6b9713babc43c6a2d52e4b6e957479.pdf?index=true, https://b7f7ba51-6064-46fc-affc-93d06ee75820.filesusr.com/ugd/38955b_66de047111f74c64b208627c5d203236.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=tafsir+al+ahlam+mktbtk
• https://be2467e7-f3a6-4236-a57c-0a2288ec77d2.filesusr.com/ugd/1d64af_bd6b9713babc43c6a2d52e4b6e957479.pdf?index=true
• https://b7f7ba51-6064-46fc-affc-93d06ee75820.filesusr.com/ugd/38955b_66de047111f74c64b208627c5d203236.pdf?index=true
• https://2fc02218-e1fd-4253-aa85-aa4fbf1c924f.filesusr.com/ugd/6a22cb_6b62abcd215a4e079b84e2b40ca6b644.pdf?index=true
• https://30b8bb08-f3d2-4917-a76b-e4acdef58a1e.filesusr.com/ugd/9ea9b6_7728b7f2350c4cbf822ddd0b7c761a1a.pdf?index=true
• http://files.desertcrewphotography.com/uploads/1/3/1/6/131607232/b4d7d20c.pdf
• http://files.somersbyschoolofarts.org/uploads/1/3/0/7/130775505/945541a9e05758.pdf
• http://files.lion-fabrications.co.uk/uploads/1/3/1/0/131070212/6237932.pdf
• http://files.foodallergymiassociation.com/uploads/1/3/2/3/132303245/28edc1.pdf
• https://0eca43ba-c365-4b5a-886c-f11d000ed84c.filesusr.com/ugd/77d535_b650b82a31a14955af21232f85096e2a.pdf?index=true
• https://256934d9-22a3-4025-84ce-cb13f4d955e9.filesusr.com/ugd/a59130_86ece5caac08486bb18914117a4c1191.pdf?index=true
• https://829df99d-b606-4045-bd4d-b0175c1acb9e.filesusr.com/ugd/9c8fb9_1b36125053414ec2a025b9d23665dcbb.pdf?index=true
• https://a7adf44d-5bb7-4ed2-8e1d-62e50e6d6c4a.filesusr.com/ugd/78daac_47c52f43f5d347a18c4c104a69551886.pdf?index=true
• https://55a31e86-0cfd-4e58-8120-cb6c1b5f843f.filesusr.com/ugd/e66789_c510440484cc47ea830f2d7f2c08ac87.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• be2467e7-f3a6-4236-a57c-0a2288ec77d2.filesusr.com
• b7f7ba51-6064-46fc-affc-93d06ee75820.filesusr.com
• 2fc02218-e1fd-4253-aa85-aa4fbf1c924f.filesusr.com
• 30b8bb08-f3d2-4917-a76b-e4acdef58a1e.filesusr.com
• files.desertcrewphotography.com
• files.somersbyschoolofarts.org
• files.lion-fabrications.co.uk
• files.foodallergymiassociation.com
• z.es
• 0eca43ba-c365-4b5a-886c-f11d000ed84c.filesusr.com
• 256934d9-22a3-4025-84ce-cb13f4d955e9.filesusr.com
• 829df99d-b606-4045-bd4d-b0175c1acb9e.filesusr.com
• a7adf44d-5bb7-4ed2-8e1d-62e50e6d6c4a.filesusr.com
• 55a31e86-0cfd-4e58-8120-cb6c1b5f843f.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report