MALICIOUS — 7fedcf_2eeb5096e26c4c31b32ada67b50a5297.pdf

MALICIOUS — 7fedcf_2eeb5096e26c4c31b32ada67b50a5297.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 8bf5d146c701c67db59d75b8ad5d91fc206b4c4fc0345f256b443700cc2f3feb
• SHA-1: c21f0e5103bf1417e6d12138aa218a05b7d9568c
• MD5: 945d1a73e1a5f791d39cc150b92a5f6e
• ssdeep: 768:5gGzpDE8aBufbDA+5gEb8RGQ6ScJ0T+/x8FtFe0WFxBSIgJ7zFOfz8pmZj:6GFgm/iRAATax89rWXBSISQL8pmZj
• TLSH: T1F633BFF75093DE8C699B5F43ADAA1198708AD3CC7123A790449A7B6CE47C0FC9F01A60
• Submitted as: 7fedcf_2eeb5096e26c4c31b32ada67b50a5297.pdf
• File type: pdf · Size: 49322 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.PDF.Agent.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.PDF.Agent.gen (rule HEUR:Trojan.PDF.Agent.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=porras+del+america+para+el+pumas, http://fuxudimi.fovvtnh.org/uploads/1/3/0/8/130814340/sijoguforepavap.pdf, http://vurulupu.herartsinaction.org/uploads/1/3/0/8/130815017/87285ae.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=porras+del+america+para+el+pumas
• http://fuxudimi.fovvtnh.org/uploads/1/3/0/8/130814340/sijoguforepavap.pdf
• http://vurulupu.herartsinaction.org/uploads/1/3/0/8/130815017/87285ae.pdf
• http://lusasu.uvoholicsanonymous.com/uploads/1/3/0/8/130814297/3594592.pdf
• http://zilux.sobritishenglish.com/uploads/1/3/2/6/132681237/5b6af86cbf6.pdf
• https://3712153a-a66c-43b1-a32a-e3456f0cf29f.filesusr.com/ugd/ccf397_063a53dde7704bccbafc0a32c5a400bd.pdf?index=true
• https://edc70e9e-5f99-46ef-9c7b-33454a5240b2.filesusr.com/ugd/9d869b_a9d2774b92ce4210a0d0ab7eff9b2900.pdf?index=true
• https://81a73e4b-da68-447f-9b8b-90a3f4e4a412.filesusr.com/ugd/38eac1_6fe50b1401fd446ba9a42384b786f9df.pdf?index=true
• https://4ea909f9-f380-4201-bce4-9064e7b83d1c.filesusr.com/ugd/7f614e_ebb68322e7ed4be2a4a0bd76af69ca31.pdf?index=true
• https://5690000a-664f-41d1-a226-23cfee3c2662.filesusr.com/ugd/39a0fd_f39ffbb9d1cc491181387be051002008.pdf?index=true
• http://files.composethestory.co/uploads/1/3/0/9/130969090/nitoxi-dawarumafix.pdf
• http://porod.venetoreview.com/uploads/1/3/0/8/130814687/gudifiwowir.pdf
• https://d45abef7-3600-4a5d-a770-f4d4eb1541fe.filesusr.com/ugd/45fd81_8157e404ba1847868a6d0f66d1a66d3f.pdf?index=true
• https://ee54aae4-274c-48d2-ac6f-e4bc8ae69372.filesusr.com/ugd/9e41f0_d55cc347108847ae8f9d2b26fc59b274.pdf?index=true
• https://f2966988-f7b7-4054-8bb7-b9315b68bc92.filesusr.com/ugd/96564c_0fa6f378785943209848d5b3ceded895.pdf?index=true
• https://328d82ae-6c30-41ed-b03f-2e6fd028c1b1.filesusr.com/ugd/f6a907_d3827dd9214c48aab59786ef517f612c.pdf?index=true
• https://72a42488-eeef-436a-a2e8-e73da5f38a88.filesusr.com/ugd/f09a9d_fa4ec7977bda4b4b8cda1f2f16de0c01.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• fuxudimi.fovvtnh.org
• vurulupu.herartsinaction.org
• lusasu.uvoholicsanonymous.com
• zilux.sobritishenglish.com
• 3712153a-a66c-43b1-a32a-e3456f0cf29f.filesusr.com
• edc70e9e-5f99-46ef-9c7b-33454a5240b2.filesusr.com
• 81a73e4b-da68-447f-9b8b-90a3f4e4a412.filesusr.com
• 4ea909f9-f380-4201-bce4-9064e7b83d1c.filesusr.com
• 5690000a-664f-41d1-a226-23cfee3c2662.filesusr.com
• files.composethestory.co
• porod.venetoreview.com
• d45abef7-3600-4a5d-a770-f4d4eb1541fe.filesusr.com
• ee54aae4-274c-48d2-ac6f-e4bc8ae69372.filesusr.com
• f2966988-f7b7-4054-8bb7-b9315b68bc92.filesusr.com
• 328d82ae-6c30-41ed-b03f-2e6fd028c1b1.filesusr.com
• 72a42488-eeef-436a-a2e8-e73da5f38a88.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report