MALICIOUS — 03ae60_d0ea2f7e138d44b2b6d828f266898217.pdf

MALICIOUS — 03ae60_d0ea2f7e138d44b2b6d828f266898217.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: b10521b6996df1b0332b98f086a62c19e0921c30e21350f1e728d30680292a3d
• SHA-1: 60278d6858a9dd96ae78985bc012e35311bbc2fd
• MD5: e12ff3430578ad4bc5cf9431c3fb9b86
• ssdeep: 768:sgGzpD5IyZaygCh2c72ZhJ2qyZwdV2qNzqYwe:pGFtl3P7AJ3BcYwe
• TLSH: T1E2318EF7509BEC8C798B6F07ADE6114DA046C78CA12395B05598772CC8BC2FD6E81A21
• Submitted as: 03ae60_d0ea2f7e138d44b2b6d828f266898217.pdf
• File type: pdf · Size: 41402 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=zombie+tsunami+hack+apk+4.0.0, http://files.richelleputnam.net/uploads/1/3/0/7/130739084/zofowime.pdf, http://moninu.videogamelegacy.com/uploads/1/3/2/3/132303382/6785660.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=zombie+tsunami+hack+apk+4.0.0
• http://files.richelleputnam.net/uploads/1/3/0/7/130739084/zofowime.pdf
• http://moninu.videogamelegacy.com/uploads/1/3/2/3/132303382/6785660.pdf
• http://files.sudaneseamericanyouthcenter.org/uploads/1/3/1/0/131070113/c0c2a8b6ebdd.pdf
• https://2ea591ec-62a0-41f1-9200-0848f39bb94c.filesusr.com/ugd/69695d_4bca5a7f6cde4b37bfb855cddd9bce3e.pdf?index=true
• https://4d50cd6e-8e98-43b1-8f08-56e4bfec742b.filesusr.com/ugd/6cf392_42b33488bfa1453c980a2559882c0ad1.pdf?index=true
• https://85576c21-dd12-4486-a6e1-e0c446d866d4.filesusr.com/ugd/440e29_35a34dd8391b43d5a19915778c6ca10e.pdf?index=true
• https://62c98027-5caf-4888-a2b6-aca9f5f1e387.filesusr.com/ugd/d8966e_d783b2e3b1424ba0812c17c0ebf1721f.pdf?index=true
• https://e29abb9b-127f-4994-9099-f67b7a2fc71d.filesusr.com/ugd/2d1648_9de4551f62eb4662b42ee673609ba829.pdf?index=true
• https://c4da6123-b2d0-4fef-9ef4-95e4883ef9de.filesusr.com/ugd/895bef_d4d12f1024a5434baf87c8540c8ab5f8.pdf?index=true
• https://8089c79c-082f-4662-aded-2f3ebc04e044.filesusr.com/ugd/bb10c5_6eba541eb89f4ef9aee3a8fe7c560c4d.pdf?index=true
• https://95e53213-aa26-4e08-8f35-2a9eb91e2a73.filesusr.com/ugd/01e791_a0a94c579cc9498d8831d6781ba552af.pdf?index=true
• https://993dabc2-886d-43d0-8c92-fdf8d1a203f3.filesusr.com/ugd/81d6a4_632c332ec1aa4b95b64be405021ed0f4.pdf?index=true
• https://42d77379-741d-484c-a84e-441afdac870e.filesusr.com/ugd/7836c9_53471533709d417787d053c63718b51c.pdf?index=true
• https://5c596c0a-e8f1-4572-a303-fd6e3a6483e0.filesusr.com/ugd/1cc777_678d91d0014b440c985db873985561d7.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• files.richelleputnam.net
• moninu.videogamelegacy.com
• files.sudaneseamericanyouthcenter.org
• 2ea591ec-62a0-41f1-9200-0848f39bb94c.filesusr.com
• 4d50cd6e-8e98-43b1-8f08-56e4bfec742b.filesusr.com
• 85576c21-dd12-4486-a6e1-e0c446d866d4.filesusr.com
• 62c98027-5caf-4888-a2b6-aca9f5f1e387.filesusr.com
• e29abb9b-127f-4994-9099-f67b7a2fc71d.filesusr.com
• c4da6123-b2d0-4fef-9ef4-95e4883ef9de.filesusr.com
• 8089c79c-082f-4662-aded-2f3ebc04e044.filesusr.com
• 95e53213-aa26-4e08-8f35-2a9eb91e2a73.filesusr.com
• 993dabc2-886d-43d0-8c92-fdf8d1a203f3.filesusr.com
• 42d77379-741d-484c-a84e-441afdac870e.filesusr.com
• 5c596c0a-e8f1-4572-a303-fd6e3a6483e0.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report