MALICIOUS — 696117_2af62de447764666bcf7f0da8723d5db.pdf

MALICIOUS — 696117_2af62de447764666bcf7f0da8723d5db.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 8191904100793cd7d5a56f7a11c49941c4708ccc82bec45b58eb7f9cdc1fac15
• SHA-1: 6df2807dc4be90263870775b6cee0dc4b943d9f6
• MD5: 5dd72aaa25867e6225f1ac0414ffa704
• ssdeep: 1536:7GFskZC7XCZ/FbZKfA3Oz/YHWZe6vG01:aFskU7MVZKY3uYgvp
• TLSH: T17334AFF340DBDC8C7987AB43A8D211546589CB8C7136AAE019C87A7CC5BC6BD7F50A21
• Submitted as: 696117_2af62de447764666bcf7f0da8723d5db.pdf
• File type: pdf · Size: 56034 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=trapezoid+and+kites+worksheet+pdf, https://76cfd4b3-5c87-4128-9b22-327f3a405dc1.filesusr.com/ugd/143c98_b50713ea745c41168193a80f43bfd50f.pdf?index=true, https://5677758d-1b99-43b8-b0c1-1ecdbd96b1e6.filesusr.com/ugd/78daac_c2f4d040811b456e91972f40a5f6349b.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=trapezoid+and+kites+worksheet+pdf
• https://76cfd4b3-5c87-4128-9b22-327f3a405dc1.filesusr.com/ugd/143c98_b50713ea745c41168193a80f43bfd50f.pdf?index=true
• https://5677758d-1b99-43b8-b0c1-1ecdbd96b1e6.filesusr.com/ugd/78daac_c2f4d040811b456e91972f40a5f6349b.pdf?index=true
• https://812bca8f-8894-4a7e-85eb-d7dcde6a3015.filesusr.com/ugd/c57cae_788cce77602d447881ffef8b5cba5129.pdf?index=true
• https://9bba85b7-6c8e-47df-8d50-e0d67b73fa8a.filesusr.com/ugd/dc8a8e_ce0aeab5aba846659f5105ae4448fc31.pdf?index=true
• https://6591e6c1-1413-43cd-ad54-29e3f33a354e.filesusr.com/ugd/80bfa9_d92bbe4a197949b78b13e903a2111d71.pdf?index=true
• http://somawed.animalfineart.co.uk/uploads/1/3/0/7/130775217/vibup.pdf
• http://files.newlifenaturalhealth.com/uploads/1/3/1/6/131636814/puxezudibejakutope.pdf
• http://files.mariabotea.com/uploads/1/3/1/4/131453870/8325935.pdf
• http://nifokaf.scfhca.org/uploads/1/3/0/8/130874493/280c983e5df.pdf
• http://files.barriecowan.com/uploads/1/3/2/6/132696155/movovapa.pdf
• http://files.progressiveair.org/uploads/1/3/1/3/131384429/2848906.pdf
• http://nirumuk.yorkregionaccidentlawyers.com/uploads/1/3/1/3/131380505/tirobep-rikita-fatupupasizo.pdf
• http://japekur.scienceclassroom.com/uploads/1/3/0/7/130776791/lorowubuju.pdf
• http://files.grandfinaleeventsanddecor.com/uploads/1/3/0/8/130874526/653e346a1.pdf
• http://junitet.friscotxfencing.com/uploads/1/3/0/8/130874575/1214522.pdf
• https://5c579ffa-0a90-46d8-a90a-6ad6f52a04a8.filesusr.com/ugd/e3325f_9d70c1e154de433aaaf09bd9b658f160.pdf?index=true
• https://2056e323-b51f-448d-b684-31e8044a8d40.filesusr.com/ugd/2994dd_86c305efd77e469e9b1a3fa8eb26320a.pdf?index=true
• https://76b1b65f-2279-4d4d-b8bd-000844742c79.filesusr.com/ugd/7f614e_3510a9056db34b3482613c318a12c56d.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• 76cfd4b3-5c87-4128-9b22-327f3a405dc1.filesusr.com
• 5677758d-1b99-43b8-b0c1-1ecdbd96b1e6.filesusr.com
• 812bca8f-8894-4a7e-85eb-d7dcde6a3015.filesusr.com
• 9bba85b7-6c8e-47df-8d50-e0d67b73fa8a.filesusr.com
• 6591e6c1-1413-43cd-ad54-29e3f33a354e.filesusr.com
• somawed.animalfineart.co.uk
• files.newlifenaturalhealth.com
• files.mariabotea.com
• nifokaf.scfhca.org
• files.barriecowan.com
• files.progressiveair.org
• nirumuk.yorkregionaccidentlawyers.com
• japekur.scienceclassroom.com
• files.grandfinaleeventsanddecor.com
• junitet.friscotxfencing.com
• 5c579ffa-0a90-46d8-a90a-6ad6f52a04a8.filesusr.com
• 2056e323-b51f-448d-b684-31e8044a8d40.filesusr.com
• 76b1b65f-2279-4d4d-b8bd-000844742c79.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report