MALICIOUS — 38eac1_97158dc8919e40628d4dc49a6cbea62b.pdf

MALICIOUS — 38eac1_97158dc8919e40628d4dc49a6cbea62b.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 7be1ef7af6eb381fa559d8207ee68457462ba7f07143a8908eec30d9eb19199d
SHA-1: 8fb1e7ed240f04d6977f191a8a230224b5141595
MD5: 0fda7d70a7e94942a302860f44c03ff9
ssdeep: 768:NgGzpDfyHrKYKU+poAhVZt1s9LNWeUgo/Zr1TO8IRTbTIlDMZRCn:uGFzyuYKUa53s9LNbUj6bTIlIyn
TLSH: T13A32BEF715ABED993AD697039DA711597046C2887032A66808DC7B7CC4B83FEAF10634
Submitted as: 38eac1_97158dc8919e40628d4dc49a6cbea62b.pdf
File type: pdf · Size: 45996 bytes
Verdict: malicious (88/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ttraff.link/wix?keyword=all+things+fall+apart+google+drive, http://mowazipox.saolinguyen.com/uploads/1/3/1/4/131482976/c3ba7355f71b.pdf, http://files.selfexposed.co/uploads/1/3/1/3/131381910/192458.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

1009 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://ttraff.link/wix?keyword=all+things+fall+apart+google+drive
http://mowazipox.saolinguyen.com/uploads/1/3/1/4/131482976/c3ba7355f71b.pdf
http://files.selfexposed.co/uploads/1/3/1/3/131381910/192458.pdf
http://weboraf.igmlegal.com/uploads/1/3/0/7/130739892/zavowavirow.pdf
https://e22d4776-cc12-4ed1-8f80-13b0e9dcc520.filesusr.com/ugd/f34323_1cf44128c7af4dfb87b1e555182001cf.pdf?index=true
https://d352bad9-92bf-4976-9daf-c035958caab1.filesusr.com/ugd/f68081_eee2e90b3f874a24870023107f6c8ca8.pdf?index=true
http://jemej.mattresslandnb.com/uploads/1/3/1/3/131383483/sinibofefirevafumave.pdf
http://files.theaterinthepark.net/uploads/1/3/1/8/131871501/8677951.pdf
https://54ff2955-3141-4b41-ac3b-48a91df226ab.filesusr.com/ugd/64bd79_1ede0eb3b4b843b9afeb0769c93a51ff.pdf?index=true
https://a6933271-3e26-4cef-b40f-ac46484b5ad4.filesusr.com/ugd/e2c6c1_3d2b0771b71a4fc79f5c9f3711b20c8f.pdf?index=true
https://7eec2876-22ef-4d7a-9bbe-9c9cabbcfde6.filesusr.com/ugd/bb05c1_3393cd3b6d0b4546ba17a0493dd99860.pdf?index=true
https://40e88a3d-4e26-4b54-af2f-86de12f96fbb.filesusr.com/ugd/733c1f_8e974bee02d74681ab2aecd46df2edfc.pdf?index=true
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ttraff.link
mowazipox.saolinguyen.com
files.selfexposed.co
weboraf.igmlegal.com
e22d4776-cc12-4ed1-8f80-13b0e9dcc520.filesusr.com
d352bad9-92bf-4976-9daf-c035958caab1.filesusr.com
jemej.mattresslandnb.com
files.theaterinthepark.net
54ff2955-3141-4b41-ac3b-48a91df226ab.filesusr.com
a6933271-3e26-4cef-b40f-ac46484b5ad4.filesusr.com
7eec2876-22ef-4d7a-9bbe-9c9cabbcfde6.filesusr.com
40e88a3d-4e26-4b54-af2f-86de12f96fbb.filesusr.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report