MALICIOUS — c8f33b_e93c9fd9b37b4041a79ec574092ad30f.pdf

MALICIOUS — c8f33b_e93c9fd9b37b4041a79ec574092ad30f.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: a07101461598a9bdeb242cc90645b17643d4024e032eadb6c79a10d3983187ec
• SHA-1: d04862b547d92078f18138c0ffde15a2f8319f97
• MD5: bc75558b99dadc04a1a5cd51a99e2d45
• ssdeep: 768:egGzpDYkWT06CqADnOEj2U2xtQ9nQCDEyafxMgmbqsNy8hvLk5NvUNye5cSnSY2K:bGFEF06LAjOEqUAMQCHa5MG8hvmNmcSj
• TLSH: T16332A0F391A3DE483987AB075EFE2819A0C9D68D6073666008C8776CD47C3BD6D52960
• Submitted as: c8f33b_e93c9fd9b37b4041a79ec574092ad30f.pdf
• File type: pdf · Size: 45601 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=school+counselling+websites, https://470ecfe9-077e-46eb-a97b-d0161cb2142e.filesusr.com/ugd/3801ff_24c442dc1fab4ba493600098cc0eaf35.pdf?index=true, https://2316d9c2-9163-46b1-9d9b-573fbe3061f1.filesusr.com/ugd/89064d_890d77be06b84d8abaf8c5a98ff6557e.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=school+counselling+websites
• https://470ecfe9-077e-46eb-a97b-d0161cb2142e.filesusr.com/ugd/3801ff_24c442dc1fab4ba493600098cc0eaf35.pdf?index=true
• https://2316d9c2-9163-46b1-9d9b-573fbe3061f1.filesusr.com/ugd/89064d_890d77be06b84d8abaf8c5a98ff6557e.pdf?index=true
• https://e3452c83-aad2-466a-881b-a3ce9292da5d.filesusr.com/ugd/95ea6b_e834ba6af1304b319474a62353776825.pdf?index=true
• http://files.gmif.gmuforensics.org/uploads/1/3/1/6/131637047/3353059.pdf
• http://nikiki.outbackequines.com/uploads/1/3/2/6/132681066/wivovin_faposakak_rufiwurapet_pufetojurozani.pdf
• https://db196131-f2ea-4198-b4c7-7181cf5c6b36.filesusr.com/ugd/b65acf_1b7cb1c1457a4a3e9d9cb4579cd3c3d9.pdf?index=true
• https://6ca4f22b-5345-42bc-8b0d-26f8bd6f1ea4.filesusr.com/ugd/735189_6cb20149c2ce48899d50555286840b48.pdf?index=true
• https://f62a9d5e-b9fc-479c-a82d-c8ff1bddfd78.filesusr.com/ugd/595093_6733ad6e16614a39ac93be97368b7c30.pdf?index=true
• https://a0845d7e-977a-4c67-86e5-d3dcd370345d.filesusr.com/ugd/ad8f3a_d09bc6c5ae0749b4ac98e2d53f4f8b03.pdf?index=true
• https://86ba7022-003c-4204-b998-fe89cfb49f55.filesusr.com/ugd/bf650e_8e9c768e59fb4f77a26dc8c3808a2920.pdf?index=true
• https://64728fb2-01c7-4107-9ba6-91be6bb1aa40.filesusr.com/ugd/fedf23_0a26574821ca4875b6ba6ec9d356a043.pdf?index=true
• https://f42c6338-0f0f-4c68-91f7-4093910ec1dc.filesusr.com/ugd/33ab24_53a7cd2571ed4a6ea74397b367c2603e.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• 470ecfe9-077e-46eb-a97b-d0161cb2142e.filesusr.com
• 2316d9c2-9163-46b1-9d9b-573fbe3061f1.filesusr.com
• e3452c83-aad2-466a-881b-a3ce9292da5d.filesusr.com
• files.gmif.gmuforensics.org
• nikiki.outbackequines.com
• db196131-f2ea-4198-b4c7-7181cf5c6b36.filesusr.com
• 6ca4f22b-5345-42bc-8b0d-26f8bd6f1ea4.filesusr.com
• f62a9d5e-b9fc-479c-a82d-c8ff1bddfd78.filesusr.com
• a0845d7e-977a-4c67-86e5-d3dcd370345d.filesusr.com
• 86ba7022-003c-4204-b998-fe89cfb49f55.filesusr.com
• 64728fb2-01c7-4107-9ba6-91be6bb1aa40.filesusr.com
• f42c6338-0f0f-4c68-91f7-4093910ec1dc.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report