MALICIOUS — 8e1900_54e1b95e7132449084f6f54bad1a260d.pdf

MALICIOUS — 8e1900_54e1b95e7132449084f6f54bad1a260d.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: 7692d6c16aa9feee1899934b75e16c408e996820c22ac5305b6308905bfdc4f7
• SHA-1: 4af865a5e479bb9585e97fd0bcf9289b3f1a491e
• MD5: 0488905042fc891b1ed5dadc42df05b5
• ssdeep: 768:wIgGzpDD4SqG7nmt+zH27GYzqNJLSlNFM9FH2BtSeUOjpWIEWd5kWpzAd:wFGF/IC++ShzMl9iXFVkWpzI
• TLSH: T1C434CFF3519BDD8C798B9B039DE902496089D6886137A77048C87A7CC8BC7FDAE105B1
• Submitted as: 8e1900_54e1b95e7132449084f6f54bad1a260d.pdf
• File type: pdf · Size: 54100 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=healthmateforever+yk15ab+user+manual, https://a2eb6bc0-092f-4398-8592-84ef960bf096.filesusr.com/ugd/c068f8_37414f97ce5e4a04ba01ad3fadf9f2f4.pdf?index=true, https://b503b7d2-8d61-4817-a60b-18cfe588ea66.filesusr.com/ugd/4d400c_0a99656c2e8d498fa4c7af4fe616844e.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=healthmateforever+yk15ab+user+manual
• https://a2eb6bc0-092f-4398-8592-84ef960bf096.filesusr.com/ugd/c068f8_37414f97ce5e4a04ba01ad3fadf9f2f4.pdf?index=true
• https://b503b7d2-8d61-4817-a60b-18cfe588ea66.filesusr.com/ugd/4d400c_0a99656c2e8d498fa4c7af4fe616844e.pdf?index=true
• https://f27b948b-8bc9-447d-b0b6-afeb1417a5fe.filesusr.com/ugd/5de1df_5df620c0c2c14747b335a50c4cf338eb.pdf?index=true
• https://22a9cc9e-99bc-4ea2-ba81-3e5fe113fbe9.filesusr.com/ugd/45fd81_2b54c4ccd75843749ee31be32f4f4bbf.pdf?index=true
• https://d3a9167d-84ca-454c-9269-725282c7df85.filesusr.com/ugd/87a178_88e3e15f45ae4dc78f544b98e18d0de9.pdf?index=true
• http://files.cbwlawyers.com/uploads/1/3/0/9/130968961/572366.pdf
• http://xelefe.nmallianceforlife.org/uploads/1/3/1/0/131070171/a7664cb.pdf
• http://bunemeto.realtalktherapy.co.uk/uploads/1/3/1/4/131453170/3194037.pdf
• http://files.pastelsocietyofsoutheasttexas.org/uploads/1/3/1/4/131410234/sozodutodibulajo.pdf
• http://gemiriv.scottwhitworthphotography.com/uploads/1/3/1/4/131407406/jopezemoga.pdf
• https://f7d6bae4-6660-4e10-bd7f-113e29093a9a.filesusr.com/ugd/c068f8_8b42faaa77b5474e8c9c83d7c84bf0f0.pdf?index=true
• https://6d7e3c53-3c76-4f3d-9f5b-9f80f9b8a64f.filesusr.com/ugd/5b9a87_b2a287ce726f4e76ad9070e5a9ede30a.pdf?index=true
• https://3a70ccd2-ceef-407b-8e90-55d8f7b14266.filesusr.com/ugd/3eed2b_3b0e2b1b25c0419e83843442749a73b1.pdf?index=true
• https://c56a437d-ddd7-4d5c-b403-1568e394d1f7.filesusr.com/ugd/3d0627_edcc45aab34940eca3530e9f3903e21a.pdf?index=true
• https://25d6cc1b-a088-48ad-9fe9-da491be72afd.filesusr.com/ugd/724fb5_4d30e47294eb4183bfe89a35a6133666.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• a2eb6bc0-092f-4398-8592-84ef960bf096.filesusr.com
• b503b7d2-8d61-4817-a60b-18cfe588ea66.filesusr.com
• f27b948b-8bc9-447d-b0b6-afeb1417a5fe.filesusr.com
• 22a9cc9e-99bc-4ea2-ba81-3e5fe113fbe9.filesusr.com
• d3a9167d-84ca-454c-9269-725282c7df85.filesusr.com
• files.cbwlawyers.com
• xelefe.nmallianceforlife.org
• bunemeto.realtalktherapy.co.uk
• files.pastelsocietyofsoutheasttexas.org
• gemiriv.scottwhitworthphotography.com
• f7d6bae4-6660-4e10-bd7f-113e29093a9a.filesusr.com
• 6d7e3c53-3c76-4f3d-9f5b-9f80f9b8a64f.filesusr.com
• 3a70ccd2-ceef-407b-8e90-55d8f7b14266.filesusr.com
• c56a437d-ddd7-4d5c-b403-1568e394d1f7.filesusr.com
• 25d6cc1b-a088-48ad-9fe9-da491be72afd.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report