MALICIOUS — 8e7730_5ca565936ef746d8ae30dffd62339949.pdf

MALICIOUS — 8e7730_5ca565936ef746d8ae30dffd62339949.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: 97db7f0745cfef5ffb34ef22d3a4bc054c0f6c4fccd098a5bf30f9ed3a6a59e3
• SHA-1: 620e5529aa263ecdfb332d180019e11c08564979
• MD5: c9c1803e683d7999e6397258bf710919
• ssdeep: 768:dgGzpDZYf90tCoX6p+QID8o6b5aIkftm2SfFaHGsyVSI8N:eGF9ZVD8Bb5fmo4HmYI8N
• TLSH: T1B231AEF35097ED8C6A879B13AEAB20556549D38C5273E72008CC7B6CD4BC6FCAE50960
• Submitted as: 8e7730_5ca565936ef746d8ae30dffd62339949.pdf
• File type: pdf · Size: 43033 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=using+a+map+scale+worksheet+answer+key, https://cdn.shopify.com/s/files/1/0431/3631/9645/files/64092854969.pdf, https://cdn.shopify.com/s/files/1/0435/2815/9396/files/rti_application_format_marathi.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=using+a+map+scale+worksheet+answer+key
• https://cdn.shopify.com/s/files/1/0431/3631/9645/files/64092854969.pdf
• https://cdn.shopify.com/s/files/1/0435/2815/9396/files/rti_application_format_marathi.pdf
• https://cdn.shopify.com/s/files/1/0447/1803/1002/files/cube_world_beginner_guide_2019.pdf
• https://cdn.shopify.com/s/files/1/0435/7767/1843/files/eric_brown_wustl.pdf
• https://2c3ace21-ece0-4f8b-9232-fd35f69f4fce.filesusr.com/ugd/e643da_3afdd5fe245c4560a315c3339502db79.pdf?index=true
• https://ab06d87d-c896-47cb-866f-d4815f8259b7.filesusr.com/ugd/9d869b_7cf3087dda6e4a08aba1b190ef7a5e26.pdf?index=true
• https://43f0651b-64a2-4ff4-8a71-77a0ef272e4d.filesusr.com/ugd/e3c460_ab5e517585924a4a97015a04c5912e7f.pdf?index=true
• https://13a29e59-92ac-4ac7-9e47-8c24cd7307e6.filesusr.com/ugd/0fdb6d_b7eee557f57f473a8e273e373be9738f.pdf?index=true
• https://6aee81f9-9814-4661-8ea1-d8b5a9239a34.filesusr.com/ugd/3a38e0_d008703639b84f03aa784e310643d301.pdf?index=true
• http://vakolil.occasionssingers.org/uploads/1/3/0/7/130775164/bafetivowujukijoge.pdf
• http://sisimonil.swansonvideoservice.com/uploads/1/3/1/4/131453741/wogunoz_wanil_wamumuzomud_jonepuk.pdf
• http://delevif.ucalgarycase.com/uploads/1/3/1/4/131482993/9e88e4cb9ef.pdf
• https://cdn.shopify.com/s/files/1/0430/8795/4073/files/97077666016.pdf
• https://cdn.shopify.com/s/files/1/0435/0722/0635/files/l_express_newspaper.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• cdn.shopify.com
• 2c3ace21-ece0-4f8b-9232-fd35f69f4fce.filesusr.com
• ab06d87d-c896-47cb-866f-d4815f8259b7.filesusr.com
• 43f0651b-64a2-4ff4-8a71-77a0ef272e4d.filesusr.com
• 13a29e59-92ac-4ac7-9e47-8c24cd7307e6.filesusr.com
• 6aee81f9-9814-4661-8ea1-d8b5a9239a34.filesusr.com
• vakolil.occasionssingers.org
• sisimonil.swansonvideoservice.com
• delevif.ucalgarycase.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report