MALICIOUS — 02ccf7_e34ee24542bc43c7ba82d400551fbff8.pdf

MALICIOUS — 02ccf7_e34ee24542bc43c7ba82d400551fbff8.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 99313a5bb93f3e8cff3e91ced210784012a00a8b332365ecb3ac34edac400a6f
• SHA-1: 599dba4a7a795e7dd05b198c09858b0c08a829eb
• MD5: 2f31dec7f5348c81422338e95219faa7
• ssdeep: 768:QgGzpDG2Dml1/N+X/xSbrEhpGlNL7QlJ0nhOjGBCpC:9GFqYXxSWpK3IJEOjGBCpC
• TLSH: T18532AEF35097ED8C7A8A6B43AEFA00597001D68CA136865098CD767CC4BC2FDBE41D61
• Submitted as: 02ccf7_e34ee24542bc43c7ba82d400551fbff8.pdf
• File type: pdf · Size: 46833 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=shooting+games+unblocked+weebly, http://vosiboru.maidans.org/uploads/1/3/1/6/131636908/soledu-nezezegexata-jikabuje.pdf, http://daboge.mylifestyle24seven.com/uploads/1/3/0/7/130776433/5340490.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=shooting+games+unblocked+weebly
• http://vosiboru.maidans.org/uploads/1/3/1/6/131636908/soledu-nezezegexata-jikabuje.pdf
• http://daboge.mylifestyle24seven.com/uploads/1/3/0/7/130776433/5340490.pdf
• http://files.thequayboddie.com/uploads/1/3/0/9/130969080/xifarukozojawujabuv.pdf
• https://cdn.shopify.com/s/files/1/0462/3669/6736/files/kivokolixijewugaxut.pdf
• https://cdn.shopify.com/s/files/1/0429/1395/6007/files/reading_plus_answers_on_instagram.pdf
• https://cdn.shopify.com/s/files/1/0433/0687/7080/files/56966684837.pdf
• https://cdn.shopify.com/s/files/1/0428/1312/8867/files/8929614000.pdf
• http://files.robbexpresssharpening.com/uploads/1/3/1/3/131378953/derajewebuzuxukagu.pdf
• http://files.odomengineering.com/uploads/1/3/0/8/130874009/7938492.pdf
• http://govuda.theclinichealthandwellness.com/uploads/1/3/1/4/131453194/6367197.pdf
• https://01e6e5f0-46f6-4c9e-ae55-3add0e8321bd.filesusr.com/ugd/595093_e6c3456860df4969b9b3fe9425013fd3.pdf?index=true
• https://9199dbb9-139f-4f39-a0d7-03685820eac5.filesusr.com/ugd/70c1ec_dc6c56f3b79f4c10b317574c2d7161aa.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• vosiboru.maidans.org
• daboge.mylifestyle24seven.com
• files.thequayboddie.com
• cdn.shopify.com
• files.robbexpresssharpening.com
• files.odomengineering.com
• govuda.theclinichealthandwellness.com
• 01e6e5f0-46f6-4c9e-ae55-3add0e8321bd.filesusr.com
• 9199dbb9-139f-4f39-a0d7-03685820eac5.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report