MALICIOUS — 24d943_4a69adc4d49a4016919fc61449d8887d.pdf

MALICIOUS — 24d943_4a69adc4d49a4016919fc61449d8887d.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 92cb49ff52b4ab5b080a4b60429415dfd859572dca1ceb7043e195f50cfe8478
• SHA-1: 073533b60e4a267ad9b0151018d3a28409e9db2f
• MD5: ddc88084bd14d92f308c90b1cb693c61
• ssdeep: 768:3gGzpDtC6otnBPXuxms5TI+EZAadFGdp707eD2znyI:QGFRkN+Jad+wznyI
• TLSH: T1BA31AEF3548BDD8C7A875703AAE61599614AD68CB13A976009DC7B2CD4BC2FDBF00860
• Submitted as: 24d943_4a69adc4d49a4016919fc61449d8887d.pdf
• File type: pdf · Size: 41058 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=free+download+full+movies+hollywood, https://cdn.shopify.com/s/files/1/0430/6917/8017/files/kebeg.pdf, https://cdn.shopify.com/s/files/1/0435/9369/5391/files/blechtrommel_download.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=free+download+full+movies+hollywood
• https://cdn.shopify.com/s/files/1/0430/6917/8017/files/kebeg.pdf
• https://cdn.shopify.com/s/files/1/0435/9369/5391/files/blechtrommel_download.pdf
• https://cdn.shopify.com/s/files/1/0430/7573/1616/files/balizuse.pdf
• https://cdn.shopify.com/s/files/1/0428/7735/4143/files/98133656616.pdf
• https://cdn.shopify.com/s/files/1/0429/4852/6246/files/natural_bridge_state_resort_park_lodge.pdf
• http://files.everlastinglovechurch.org/uploads/1/3/1/4/131437619/duporawojuw.pdf
• http://files.lifestylefitness.club/uploads/1/3/1/4/131407135/kufelododigadif.pdf
• http://didov.trippworx.com/uploads/1/3/1/6/131606183/18352ba.pdf
• https://cdn.shopify.com/s/files/1/0430/5430/1338/files/37066376954.pdf
• https://cdn.shopify.com/s/files/1/0437/1070/9913/files/10222621659.pdf
• https://cdn.shopify.com/s/files/1/0432/3069/1496/files/rapuziwadowedazi.pdf
• https://7bd9aed0-01d6-416e-8f73-93c5a47e323c.filesusr.com/ugd/a31856_4d5209ad135e4682b5edef305a2eedca.pdf?index=true
• https://1ef70f94-d04b-4354-b03e-ff47bd77fce7.filesusr.com/ugd/2813e2_81973dca13ab42c6b044cb2f6a259316.pdf?index=true
• https://4a513928-bf11-4c01-a9cd-a832bf598479.filesusr.com/ugd/15ebe2_575308b5c25347f78d502c72ae1cf461.pdf?index=true
• https://820a9583-fc53-45fc-8e64-11d4b3261770.filesusr.com/ugd/48bf55_93370d1c997e44c8a082e456eac2f65e.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• cdn.shopify.com
• files.everlastinglovechurch.org
• files.lifestylefitness.club
• didov.trippworx.com
• 7bd9aed0-01d6-416e-8f73-93c5a47e323c.filesusr.com
• 1ef70f94-d04b-4354-b03e-ff47bd77fce7.filesusr.com
• 4a513928-bf11-4c01-a9cd-a832bf598479.filesusr.com
• 820a9583-fc53-45fc-8e64-11d4b3261770.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report