MALICIOUS — 4fea5c_02d5f069b9b945babff20bb093b5282a.pdf

MALICIOUS — 4fea5c_02d5f069b9b945babff20bb093b5282a.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 90bd34ae3488c4a90d2b4dbfe30719f27417dc0776de29d16883073a92149bb4
• SHA-1: 25ede4e4fb2cb348228d8b5e7f473324cfedadf5
• MD5: abcbb39df5e4511b03528e597aa199eb
• ssdeep: 768:ygGzpDW7z+osgNv9CBNc861MAi+F6BpVcqt88qVhlY5oXzuZ/oSP99:vGFKt0u1MAihpVcqIrS5oc/oSP99
• TLSH: T17033ADF3505BEC8C7ACAAF077DA7106D6199D78C7032A27448D8B62CD57C6EC6E01920
• Submitted as: 4fea5c_02d5f069b9b945babff20bb093b5282a.pdf
• File type: pdf · Size: 48444 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.PDF.Agent.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.PDF.Agent.gen (rule HEUR:Trojan.PDF.Agent.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=adobe+photoshop+cc+2020+review, http://rinuxam.leadpyramidpublishing.com/uploads/1/3/2/6/132695663/tufijakutat.pdf, http://dujijam.triplecrownvolleyball.com/uploads/1/3/1/4/131406202/famevixap.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=adobe+photoshop+cc+2020+review
• http://rinuxam.leadpyramidpublishing.com/uploads/1/3/2/6/132695663/tufijakutat.pdf
• http://dujijam.triplecrownvolleyball.com/uploads/1/3/1/4/131406202/famevixap.pdf
• http://wapakanax.mk-bricks.ca/uploads/1/3/0/8/130814328/gejoxijakuxila_zetitusoz.pdf
• http://files.snugpubcocoavillage.com/uploads/1/3/1/4/131406781/6011662.pdf
• https://455b810d-09e4-498b-a28f-6f1e4c1f7362.filesusr.com/ugd/d61b30_3595040ec40e44f4bdc7c55e3c9cdfd6.pdf?index=true
• https://9fe6d368-1f04-4b9c-b607-a7c12b20f353.filesusr.com/ugd/fd7405_2f7f5de7f3724d4ca2a8932527f34f5a.pdf?index=true
• https://04fd528e-01cb-4304-8a23-14c2b7f00b20.filesusr.com/ugd/26481d_25d7e0edf90249a28ef123bcd1d6396a.pdf?index=true
• https://3a28d287-3ef8-4ec1-b820-e9f075e31f4e.filesusr.com/ugd/ce4b7c_932a46b12f4e414ba9158371061d4708.pdf?index=true
• https://ead19138-0da5-4685-88f4-6a3594de2b2b.filesusr.com/ugd/c7a620_bbfbec1687cf432ca00f93f856c1f781.pdf?index=true
• https://cdn.shopify.com/s/files/1/0432/4789/4683/files/cid_vs_adaalat_full_video.pdf
• https://cdn.shopify.com/s/files/1/0439/0905/4619/files/english_dictionary_file_download.pdf
• https://cdn.shopify.com/s/files/1/0434/2343/2861/files/buwegefufagikodeno.pdf
• https://cdn.shopify.com/s/files/1/0428/0903/2863/files/40697675862.pdf
• https://cdn.shopify.com/s/files/1/0434/4761/5649/files/justice_league_cartoon_network_episodes.pdf
• https://cdn.shopify.com/s/files/1/0432/3940/7784/files/valekadi.pdf
• https://cdn.shopify.com/s/files/1/0431/4903/3627/files/appropriate_preposition_list_download.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• rinuxam.leadpyramidpublishing.com
• dujijam.triplecrownvolleyball.com
• wapakanax.mk-bricks.ca
• files.snugpubcocoavillage.com
• 455b810d-09e4-498b-a28f-6f1e4c1f7362.filesusr.com
• 9fe6d368-1f04-4b9c-b607-a7c12b20f353.filesusr.com
• 04fd528e-01cb-4304-8a23-14c2b7f00b20.filesusr.com
• 3a28d287-3ef8-4ec1-b820-e9f075e31f4e.filesusr.com
• ead19138-0da5-4685-88f4-6a3594de2b2b.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report