MALICIOUS — 5c9621_13905bc19ce8490f8912f5a1b71028dd.pdf

MALICIOUS — 5c9621_13905bc19ce8490f8912f5a1b71028dd.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

SHA-256: 72a479c8638af46d8ae012a66e02b828c5609c44c256f979bfb835f68373fb75
SHA-1: ce40e608aacad87c1e37ed74fde09d10c07827c9
MD5: 9d56baa6b0d8867e99de9b853d230e67
ssdeep: 768:BgGzpDTyjWTnp9SN0ML4lZlSBO2r2Qgdya57VT2BK1I:yGF/giU4p6f8oBKO
TLSH: T1DC309EF3509BDD8C6A87EB0369F600596147D78C2232EBA45998377CD8BC6BC6E50C60
Submitted as: 5c9621_13905bc19ce8490f8912f5a1b71028dd.pdf
File type: pdf · Size: 37979 bytes
Verdict: malicious (88/100)

Detections (3 of 54 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ttraff.club/wix?keyword=panda+chinese+restaurant+commerce+tx, https://2f62ba1c-d601-4fa8-8555-b6470f7ba64c.filesusr.com/ugd/4a2613_abfd4a6df2664f898db2a06c605b0b4d.pdf?index=true, https://4647869b-9e1f-458e-86dc-6b895a3058f0.filesusr.com/ugd/ebcc4b_f22f79d428034e9b8fd23e2e4fc76375.pdf?index=true - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://ttraff.club/wix?keyword=panda+chinese+restaurant+commerce+tx
https://2f62ba1c-d601-4fa8-8555-b6470f7ba64c.filesusr.com/ugd/4a2613_abfd4a6df2664f898db2a06c605b0b4d.pdf?index=true
https://4647869b-9e1f-458e-86dc-6b895a3058f0.filesusr.com/ugd/ebcc4b_f22f79d428034e9b8fd23e2e4fc76375.pdf?index=true
https://348a953d-d37e-419c-a71f-c98ff8abe304.filesusr.com/ugd/54b9a1_869bc0f0b22842b8bcbd2672a9cd8766.pdf?index=true
http://sizaxit.foresthillbroncos.com/uploads/1/3/0/7/130739431/1424113.pdf
http://files.springmaths.org/uploads/1/3/1/4/131406348/vafat.pdf
https://cdn.shopify.com/s/files/1/0431/0922/0503/files/acrobat_maker_for_windows_7_free_download.pdf
https://cdn.shopify.com/s/files/1/0433/6975/8874/files/kexililinafutazudidugob.pdf
https://cdn.shopify.com/s/files/1/0429/9853/0201/files/xexabobiwubolumubare.pdf
https://cdn.shopify.com/s/files/1/0433/9436/7649/files/nugejarawojaza.pdf
https://88c9223e-79ee-4ee4-b646-839b9b3bdabf.filesusr.com/ugd/3c8574_5f38aaae495d4755be7d3e0078aaafaa.pdf?index=true
https://0a256a21-ec23-4df4-8e9d-d9967d542ecc.filesusr.com/ugd/2eec94_c3f6fd639c0a431fa482ba0dd15bf3f1.pdf?index=true
https://45744822-d205-4884-8b14-8d92c1769330.filesusr.com/ugd/764aaa_a6515454e06545d9b5d1a7838d3bcf70.pdf?index=true
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ttraff.club
2f62ba1c-d601-4fa8-8555-b6470f7ba64c.filesusr.com
4647869b-9e1f-458e-86dc-6b895a3058f0.filesusr.com
348a953d-d37e-419c-a71f-c98ff8abe304.filesusr.com
sizaxit.foresthillbroncos.com
files.springmaths.org
cdn.shopify.com
88c9223e-79ee-4ee4-b646-839b9b3bdabf.filesusr.com
0a256a21-ec23-4df4-8e9d-d9967d542ecc.filesusr.com
45744822-d205-4884-8b14-8d92c1769330.filesusr.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report