MALICIOUS — 3d0627_f803351745d84990870b0736ccbacbbe.pdf

MALICIOUS — 3d0627_f803351745d84990870b0736ccbacbbe.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 896d8d9d1b890754e468cec9d0cbe414856ee7b20d019f831a6cbd29dc0f6c81
• SHA-1: ec475e113b7e29bc1714e76643699562f8b2e2cf
• MD5: 26f0dab07f3bff34a16fe3808fc02890
• ssdeep: 768:egGzpDxttqo6PJDaY9CFwLQI9X8zKBS1DpI+7iWEmqoX/F193d:bGFFiG9Ip8uidI+7iWEmqC193d
• TLSH: T11431AEF38097ECCC7B8A9B139AA615596545CA8D70339AB044C83B2CC47C6EE6F11B60
• Submitted as: 3d0627_f803351745d84990870b0736ccbacbbe.pdf
• File type: pdf · Size: 41474 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=voltage+worksheet+ks3, http://newijoram.kapitiflyfishing.org/uploads/1/3/1/0/131070171/bf22946858126.pdf, http://ripovud.timsguitar.net/uploads/1/3/1/3/131378898/gamus-sedexopusomuzap.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=voltage+worksheet+ks3
• http://newijoram.kapitiflyfishing.org/uploads/1/3/1/0/131070171/bf22946858126.pdf
• http://ripovud.timsguitar.net/uploads/1/3/1/3/131378898/gamus-sedexopusomuzap.pdf
• http://files.penguinprof.com/uploads/1/3/1/4/131437532/forud-wafib.pdf
• http://files.pilateshighfields.com/uploads/1/3/1/6/131606331/romudetuwidiwu.pdf
• https://6bc74958-c2bd-41aa-8b10-a7fe615495b6.filesusr.com/ugd/6cf392_56f24d9491ae481f8666e831976a83da.pdf?index=true
• https://8956d162-b3ff-4770-bc6f-d5e06f93c1d0.filesusr.com/ugd/c8df25_da4cdd08d02548c8a7c00aa39980e8a5.pdf?index=true
• https://9589abf9-b7e4-42a5-b5eb-420d0438d222.filesusr.com/ugd/69695d_07d98ec74edb4a4185516a2bacfbe139.pdf?index=true
• https://7614a711-242f-4178-b4dd-ece54feac997.filesusr.com/ugd/9d66c7_2ca51504a53d4664ad147abefb86c933.pdf?index=true
• https://98f5dbdf-d334-46d1-83df-051669788052.filesusr.com/ugd/405339_15916d5cd0704dd294f5b295c4f8b5ed.pdf?index=true
• https://cdn.shopify.com/s/files/1/0430/4555/2290/files/35468640959.pdf
• https://cdn.shopify.com/s/files/1/0433/0687/7080/files/letowopebofowebizuwir.pdf
• https://cdn.shopify.com/s/files/1/0432/7312/6052/files/46745688971.pdf
• https://cdn.shopify.com/s/files/1/0449/0782/3259/files/boarding_pass_example.pdf
• https://cdn.shopify.com/s/files/1/0432/1142/3902/files/13433937212.pdf
• https://cdn.shopify.com/s/files/1/0428/0742/7238/files/85146551964.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• newijoram.kapitiflyfishing.org
• ripovud.timsguitar.net
• files.penguinprof.com
• files.pilateshighfields.com
• 6bc74958-c2bd-41aa-8b10-a7fe615495b6.filesusr.com
• 8956d162-b3ff-4770-bc6f-d5e06f93c1d0.filesusr.com
• 9589abf9-b7e4-42a5-b5eb-420d0438d222.filesusr.com
• 7614a711-242f-4178-b4dd-ece54feac997.filesusr.com
• 98f5dbdf-d334-46d1-83df-051669788052.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report