MALICIOUS — 0286dd_5e43d015eecd4821b1a315fd2e7ad7cf.pdf

MALICIOUS — 0286dd_5e43d015eecd4821b1a315fd2e7ad7cf.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 7885784fd3c054f762720775697d3d9248121c91be6189dce47a0711fe2468e1
• SHA-1: 38dbbf699124fafe2617b3bd1f603f0d15c69a04
• MD5: 950c3a4e1069cc538f2855f409795243
• ssdeep: 768:HgGzpDswgpDx1sjJYzZhxGK6bzaXEcX0pFNEGo3ZLofPz/p:AGFIZd1yJYz7x23a0cXWWt6jp
• TLSH: T1C2329DF350D7EC8C798E5F03AAE6115D218B928D6127A79054987B2DC0786FEBF10A31
• Submitted as: 0286dd_5e43d015eecd4821b1a315fd2e7ad7cf.pdf
• File type: pdf · Size: 45798 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=my+singing+monster+cheats+2020, http://gutixa.skeshmm.com/uploads/1/3/1/4/131407316/xixebajanoxibunezava.pdf, http://jorosef.anti-agingbyrjxjelly.com/uploads/1/3/2/3/132303354/8686563.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=my+singing+monster+cheats+2020
• http://gutixa.skeshmm.com/uploads/1/3/1/4/131407316/xixebajanoxibunezava.pdf
• http://jorosef.anti-agingbyrjxjelly.com/uploads/1/3/2/3/132303354/8686563.pdf
• http://xisigedo.cjhookah.com/uploads/1/3/0/8/130874455/tawuwekos-regivakufo.pdf
• https://de8721d9-9e37-405d-b5ea-6964fcd1657a.filesusr.com/ugd/c4dbd3_c10f01bcacee47018e97ce431a5f1314.pdf?index=true
• https://010f1c4b-3b3c-4233-af97-6adcb68819b5.filesusr.com/ugd/53c654_daa338de82404854a4d15bdb9b27069a.pdf?index=true
• https://eb3b4484-2d7e-4b56-a228-2bb980f6a8e7.filesusr.com/ugd/3283b0_c198c01e69ba4b48bd3f65676b29025d.pdf?index=true
• https://8e0d41e6-7719-4638-b8ac-025023c7b232.filesusr.com/ugd/3db607_efb4917eb2e2465e825aa96a95388c9f.pdf?index=true
• https://adaca82c-bcdf-4b7d-9ad3-1794181a402f.filesusr.com/ugd/3283b0_0efd3362cacf41e29aa01180b9fa26a5.pdf?index=true
• https://71689324-3992-44d7-b8d2-939ee3e92b08.filesusr.com/ugd/595093_46b316bb289d417b9dbd66682952cc29.pdf?index=true
• https://4438d539-81cc-4fec-acfd-0e31b44e3167.filesusr.com/ugd/3f0e57_46821265ba2e48b98cc0b7a13988f39a.pdf?index=true
• https://9631aa3d-920d-483c-85a6-d92af94480cf.filesusr.com/ugd/c8f33b_46485d60fe754f3b96803d0f6b918a35.pdf?index=true
• https://6755e3e5-51bf-4b63-9d44-2ebc5ebea627.filesusr.com/ugd/98e2de_9cacfacc1ae84c9da1417ac8358963a0.pdf?index=true
• https://f0282ac7-7221-42a1-abba-e3ddf2fda63d.filesusr.com/ugd/5f5755_2d2663cef14b41c6af82f98ce041fcbe.pdf?index=true
• https://ae66d90f-821f-419c-8caa-13ddf8204ce6.filesusr.com/ugd/1cc777_1f5bffac47c649538c7524aba710cb26.pdf?index=true
• https://d9cdd732-778e-427f-9cfb-46758ec99a64.filesusr.com/ugd/610d21_4f46ec9454144a0d9e81e5108e9efef9.pdf?index=true
• https://f378b847-c650-4dbf-b02a-a42c86e1087a.filesusr.com/ugd/8da65f_a918376ebd76492e836dfaa1695774f2.pdf?index=true
• https://73d8d6e8-4713-45ea-bf29-d77d317feb5c.filesusr.com/ugd/98e2de_d2e274b67dfb439fa744b453a63159df.pdf?index=true
• https://214c168f-91b4-4024-8b15-a9982a0ff469.filesusr.com/ugd/f6336d_c86001d776344099be36873e2becfe3c.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• gutixa.skeshmm.com
• jorosef.anti-agingbyrjxjelly.com
• xisigedo.cjhookah.com
• de8721d9-9e37-405d-b5ea-6964fcd1657a.filesusr.com
• 010f1c4b-3b3c-4233-af97-6adcb68819b5.filesusr.com
• eb3b4484-2d7e-4b56-a228-2bb980f6a8e7.filesusr.com
• 8e0d41e6-7719-4638-b8ac-025023c7b232.filesusr.com
• adaca82c-bcdf-4b7d-9ad3-1794181a402f.filesusr.com
• 71689324-3992-44d7-b8d2-939ee3e92b08.filesusr.com
• 4438d539-81cc-4fec-acfd-0e31b44e3167.filesusr.com
• 9631aa3d-920d-483c-85a6-d92af94480cf.filesusr.com
• 6755e3e5-51bf-4b63-9d44-2ebc5ebea627.filesusr.com
• f0282ac7-7221-42a1-abba-e3ddf2fda63d.filesusr.com
• ae66d90f-821f-419c-8caa-13ddf8204ce6.filesusr.com
• d9cdd732-778e-427f-9cfb-46758ec99a64.filesusr.com
• f378b847-c650-4dbf-b02a-a42c86e1087a.filesusr.com
• 73d8d6e8-4713-45ea-bf29-d77d317feb5c.filesusr.com
• 214c168f-91b4-4024-8b15-a9982a0ff469.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report