MALICIOUS — 3f8d85_829aef6a8e0b43e5a8122a2361b89654.pdf

MALICIOUS — 3f8d85_829aef6a8e0b43e5a8122a2361b89654.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 737d989aa1619b2eae68423bc1a28fef94b863e6d4f62c561a6de822062c649d
• SHA-1: e3a78659b774287d9697ec4245ff88c0bc1d50d1
• MD5: 189adc7989adcdd3512d10d396d928d6
• ssdeep: 768:QgGzpDZVpBXWi4V+YMc0jghPhY2zirxJgg7EBMT5AlEzBt7S4T:9GFd6ighPhFUxv95AcBt7vT
• TLSH: T1E1307DF3009BED8C7D87AB836DA611996089D7897233E76049D8672CC87C1BDBF10961
• Submitted as: 3f8d85_829aef6a8e0b43e5a8122a2361b89654.pdf
• File type: pdf · Size: 37146 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=skam+france+season+3+episode+5+t%25C3%25BCrk%25C3%25A7e+altyaz%25C4%25B1l%25C4%25B1, https://cdn.shopify.com/s/files/1/0434/8185/8214/files/examen_psicometrico_laboral_con_respuestas.pdf, https://cdn.shopify.com/s/files/1/0434/3581/9173/files/dipifag.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=skam+france+season+3+episode+5+t%25C3%25BCrk%25C3%25A7e+altyaz%25C4%25B1l%25C4%25B1
• https://cdn.shopify.com/s/files/1/0434/8185/8214/files/examen_psicometrico_laboral_con_respuestas.pdf
• https://cdn.shopify.com/s/files/1/0434/3581/9173/files/dipifag.pdf
• https://cdn.shopify.com/s/files/1/0438/4574/6838/files/55459600991.pdf
• http://jakapat.havenhomeandgarden.com/uploads/1/3/1/3/131380005/samuwer.pdf
• http://xesij.trinityjamestown.com/uploads/1/3/0/7/130738765/1ed3b4310ff1.pdf
• http://files.pittsborotoys.com/uploads/1/3/1/3/131380564/7885da1fef1.pdf
• http://files.breakpointny.com/uploads/1/3/1/3/131383743/90ef2dc1fc3.pdf
• http://devedime.pesfusd.com/uploads/1/3/1/4/131482916/9602127.pdf
• https://2cfd4285-9233-4079-84df-8090aeacac25.filesusr.com/ugd/d775a9_73ef6bc780944b4598308f99f47067d8.pdf?index=true
• https://601fbd12-125a-4dda-878b-9fa89468a4a3.filesusr.com/ugd/d2759c_d80e2dd3cd4e47d8a495668d85f4b3ff.pdf?index=true
• https://8b051278-9216-4b61-98c1-6382dac66f30.filesusr.com/ugd/4c1554_f8a0af121083437e81929ce0f09f8aa9.pdf?index=true
• https://fb00783e-3992-4750-8206-3dfd0144c340.filesusr.com/ugd/221eaa_6abd0f3415964528a9657a8502cd3116.pdf?index=true
• https://cdn.shopify.com/s/files/1/0431/5466/9729/files/71905525700.pdf
• https://cdn.shopify.com/s/files/1/0460/1964/1503/files/dumovawibukeveluvirixaz.pdf
• https://cdn.shopify.com/s/files/1/0431/9179/5875/files/gma_news_reporters_names.pdf
• https://cdn.shopify.com/s/files/1/0432/7404/3552/files/decimal_division_and_multiplication_word_problems_worksheets.pdf
• https://cdn.shopify.com/s/files/1/0434/6845/6086/files/pojavutunikowoxa.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• https://dizipub.net/duyurular/Nrielenler
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• cdn.shopify.com
• jakapat.havenhomeandgarden.com
• xesij.trinityjamestown.com
• files.pittsborotoys.com
• files.breakpointny.com
• devedime.pesfusd.com
• 2cfd4285-9233-4079-84df-8090aeacac25.filesusr.com
• 601fbd12-125a-4dda-878b-9fa89468a4a3.filesusr.com
• 8b051278-9216-4b61-98c1-6382dac66f30.filesusr.com
• fb00783e-3992-4750-8206-3dfd0144c340.filesusr.com
• www.w3.org
• purl.org
• dizipub.net
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report