MALICIOUS — 1b8612_f51bf53ff92b4079b7d6b3ba08bc4bff.pdf

MALICIOUS — 1b8612_f51bf53ff92b4079b7d6b3ba08bc4bff.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: 95a98398a03add9a521218eeb6467ac7e79d306d08a59739f96d776826272b92
• SHA-1: d22af4b20f068acaceabad22d8c91d682814dc50
• MD5: c02350d273e3ebe26e54ed729ef6a8e5
• ssdeep: 768:MgGzpDcVXFTE/RQKYWpGPBT4lFBQKLGQ4jtkp2+BeikNA4g:JGFYs8p4XBQGGTjtkM+BNkVg
• TLSH: T17932AEFB40ABEC8CBA9A9713BCA701169086D7887137E76055DC763DD9BC1BC9E40821
• Submitted as: 1b8612_f51bf53ff92b4079b7d6b3ba08bc4bff.pdf
• File type: pdf · Size: 46147 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=fpc+study+guide, http://dosug.rockchurchestates.com/uploads/1/3/0/7/130776008/7060118.pdf, http://tejawaf.tinderforestnatureschool.com/uploads/1/3/0/7/130739561/kusepek.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=fpc+study+guide
• http://dosug.rockchurchestates.com/uploads/1/3/0/7/130776008/7060118.pdf
• http://tejawaf.tinderforestnatureschool.com/uploads/1/3/0/7/130739561/kusepek.pdf
• http://pitozeg.peacelilywellness.com/uploads/1/3/0/7/130776861/a8bd8c3dd14.pdf
• http://files.kauffmanskeep.com/uploads/1/3/0/8/130814666/pomanidafavuka_jasadovatud.pdf
• http://files.istanbulletinonline.com/uploads/1/3/1/6/131606467/siduxud-sizevo.pdf
• https://cdn.shopify.com/s/files/1/0435/1436/4059/files/bewivujomurixupu.pdf
• https://cdn.shopify.com/s/files/1/0434/7386/2808/files/81609985122.pdf
• https://cdn.shopify.com/s/files/1/0435/3146/8951/files/31641179483.pdf
• https://cdn.shopify.com/s/files/1/0431/6299/2795/files/fuxijezesoluzisujitiwazem.pdf
• https://cdn.shopify.com/s/files/1/0434/7750/0057/files/physics_lab_report_discussion_example.pdf
• http://files.kevinanthonyhull.com/uploads/1/3/0/8/130874266/9024802.pdf
• http://files.thewhiptones.com/uploads/1/3/1/4/131437276/b8c7bbbed5752b.pdf
• http://files.pristineyc.com/uploads/1/3/1/4/131438759/jokuwipiwixur.pdf
• http://nixil.interlock.com.sg/uploads/1/3/0/7/130775971/5959feb561299.pdf
• https://c0c239cb-de60-4cc3-9097-9ee90a8574ad.filesusr.com/ugd/a31856_5eb0ab0bb65d4940a5b7463c3d69a90b.pdf?index=true
• https://ccb5a1c1-d4f3-4b4e-b1b9-e6205b3819f7.filesusr.com/ugd/625844_5b4576f0b894496a8e5438d2dee0a6bb.pdf?index=true
• https://eb2fc0e5-3c72-428f-83ee-ac0caced3a8e.filesusr.com/ugd/221eaa_27d16db956b44ac09766a7b851e9a66b.pdf?index=true
• https://90f00b74-628f-4aaf-ba32-594d842c78b3.filesusr.com/ugd/d5415a_8c6008bdef514e9b8d4e50a2785df127.pdf?index=true
• https://3cfe460d-05b3-4a1f-a40f-2975f19fb6c4.filesusr.com/ugd/4aae87_3a5c2b89d86643fc9a607fa7c2698488.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/

Embedded domains

• ttraff.com
• dosug.rockchurchestates.com
• tejawaf.tinderforestnatureschool.com
• pitozeg.peacelilywellness.com
• files.kauffmanskeep.com
• files.istanbulletinonline.com
• cdn.shopify.com
• files.kevinanthonyhull.com
• files.thewhiptones.com
• files.pristineyc.com
• nixil.interlock.com.sg
• c0c239cb-de60-4cc3-9097-9ee90a8574ad.filesusr.com
• ccb5a1c1-d4f3-4b4e-b1b9-e6205b3819f7.filesusr.com
• eb2fc0e5-3c72-428f-83ee-ac0caced3a8e.filesusr.com
• 90f00b74-628f-4aaf-ba32-594d842c78b3.filesusr.com
• 3cfe460d-05b3-4a1f-a40f-2975f19fb6c4.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report