MALICIOUS — 0789d5_fe20ae83a193454fb6449a0e6b6a0474.pdf

MALICIOUS — 0789d5_fe20ae83a193454fb6449a0e6b6a0474.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: bd6b6b2df116ac4ddd9f1ab7179ef5cd0cee2cac2709b7218fb463ccdbcc7f17
• SHA-1: 0c095abc34afb5b4f9b10d5af4d9cef2c5ee7a9a
• MD5: 80b72d15e2100335f202eb8a1c56f60d
• ssdeep: 768:ZgGzpDHgP/z99oYWCRV1Entb7YSMuPHBW3wWL38gNAwOTxxjilHgSYcqkjd11g/5:aGFDOoBBJ5P83w8bNAwOxdilH/Ig11g5
• TLSH: T118328CF35097EC4C7AC7AB5369AA2429614AD74C6133DBA0548C373CC9BC6BDBE10960
• Submitted as: 0789d5_fe20ae83a193454fb6449a0e6b6a0474.pdf
• File type: pdf · Size: 46264 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=kentucky+driver+license+test+in+arabic, https://cdn.shopify.com/s/files/1/0432/9521/1680/files/contemplate_life_at_the_lake.pdf, https://cdn.shopify.com/s/files/1/0436/1181/6099/files/jerisixizakiluli.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=kentucky+driver+license+test+in+arabic
• https://cdn.shopify.com/s/files/1/0432/9521/1680/files/contemplate_life_at_the_lake.pdf
• https://cdn.shopify.com/s/files/1/0436/1181/6099/files/jerisixizakiluli.pdf
• https://cdn.shopify.com/s/files/1/0431/6528/6564/files/19736986710.pdf
• https://cdn.shopify.com/s/files/1/0433/0687/7080/files/balevogigadan.pdf
• http://ruzer.venturecreationcafe.com/uploads/1/3/1/1/131164250/vakufakupogor-vedukonoguxid.pdf
• http://files.ledyardeducation.org/uploads/1/3/1/4/131409884/wabonewidipiva_kepokejo.pdf
• http://pezapim.clayimpressionspottery.com/uploads/1/3/1/6/131606289/16e90f23445ba.pdf
• https://c288df73-8656-4f24-a0a7-1c9c69ac61be.filesusr.com/ugd/2994dd_477fd5f9c2e343eeb1cffc35ac4378f9.pdf?index=true
• https://1827b85c-b2dd-459f-b7b4-68c54900d218.filesusr.com/ugd/dcc11b_dce5625eb2144b3f9551015fa2676ad5.pdf?index=true
• https://bed54733-f871-40a5-9e79-ba5af4a10202.filesusr.com/ugd/4c7633_a6cafd64cef744998629594f0015afcb.pdf?index=true
• https://70f64b1e-e95c-4050-a40a-02c8b0f10500.filesusr.com/ugd/c79b1c_ba86ecf60e624cdb8f1ef17a968d384d.pdf?index=true
• https://8f8381dd-c252-4ec1-900e-73a725ca135e.filesusr.com/ugd/6a7407_a4e547caf4d141c7819255a0d58e0e68.pdf?index=true
• https://cdn.shopify.com/s/files/1/0437/8243/9063/files/daily_routine_template.pdf
• https://cdn.shopify.com/s/files/1/0447/8880/9879/files/causes_of_occupational_diseases.pdf
• https://cdn.shopify.com/s/files/1/0434/3608/1308/files/55902864047.pdf
• https://cdn.shopify.com/s/files/1/0431/6381/1997/files/alternative_medicine_in_australia_ielts_reading_answer.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• cdn.shopify.com
• ruzer.venturecreationcafe.com
• files.ledyardeducation.org
• pezapim.clayimpressionspottery.com
• c288df73-8656-4f24-a0a7-1c9c69ac61be.filesusr.com
• 1827b85c-b2dd-459f-b7b4-68c54900d218.filesusr.com
• bed54733-f871-40a5-9e79-ba5af4a10202.filesusr.com
• 70f64b1e-e95c-4050-a40a-02c8b0f10500.filesusr.com
• 8f8381dd-c252-4ec1-900e-73a725ca135e.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report