MALICIOUS — 7d2910_f5fa3fa599444c3d9a3a4c4ee4b4ba8b.pdf

MALICIOUS — 7d2910_f5fa3fa599444c3d9a3a4c4ee4b4ba8b.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: c27fd9ba0cf85a44c682db442e34b8ccd431ae2cd438bd5177e86ece15c3e3ac
• SHA-1: 422c86204161c2c1cc9aff8455e59a6f7a2e4601
• MD5: a2fa5c45744488b4bbc80edc04f1a434
• ssdeep: 768:CgGzpDr0HM8GAvtLBx6aQMuVaVgX3qI6L3+OTIpQoKre:fGFH2M2FZBGnq5r+OMpxKre
• TLSH: T158318DF31097FC8C3A9F9B439AEB11992186D68D2133A66049987B2CC47C7ED7E10971
• Submitted as: 7d2910_f5fa3fa599444c3d9a3a4c4ee4b4ba8b.pdf
• File type: pdf · Size: 39613 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=fred+p+hamilton+career+center+seneca+sc+29672, https://3d3a4c52-6eb8-48da-8813-3b36050d01d5.filesusr.com/ugd/24d943_6f90ef9867e444198bd7d77c8258e289.pdf?index=true, https://4185ba4b-8c55-4116-9701-315948ae89cd.filesusr.com/ugd/c5d40f_234f1071dc364e1f9e9d6cc519be71bc.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=fred+p+hamilton+career+center+seneca+sc+29672
• https://3d3a4c52-6eb8-48da-8813-3b36050d01d5.filesusr.com/ugd/24d943_6f90ef9867e444198bd7d77c8258e289.pdf?index=true
• https://4185ba4b-8c55-4116-9701-315948ae89cd.filesusr.com/ugd/c5d40f_234f1071dc364e1f9e9d6cc519be71bc.pdf?index=true
• https://67ee0e26-eb75-43ed-9a21-34b09e35fde3.filesusr.com/ugd/8508de_e0d04834a09f48c29d87cb6ca673e126.pdf?index=true
• https://99f14fe3-e99a-40b8-9446-e3faef6adb36.filesusr.com/ugd/595093_cdadda4f94f34325b82537e7f0f53e2a.pdf?index=true
• https://817153ab-3ffd-424d-9095-ab8abf8483c6.filesusr.com/ugd/bdc04d_1fa1b5952c5a4dbbbf97f13487af606e.pdf?index=true
• http://zalozixuv.caavd.ca/uploads/1/3/1/4/131438641/db28800e11.pdf
• http://vapizu.canadiancoachbaker.com/uploads/1/3/1/3/131383621/db73f7aa55.pdf
• http://files.panasiatourist.com/uploads/1/3/2/7/132740193/xawokap.pdf
• http://vemazigex.georgepritchard.com/uploads/1/3/1/1/131164250/komipim.pdf
• http://files.vocesintimaeartsong.com/uploads/1/3/2/6/132681826/cd8e15f31cea0.pdf
• https://cdn.shopify.com/s/files/1/0430/8946/1410/files/46748640611.pdf
• https://cdn.shopify.com/s/files/1/0428/5235/2156/files/tatelusipefexaj.pdf
• https://cdn.shopify.com/s/files/1/0468/0079/7847/files/curriculum_central_scsd.pdf
• https://bef7ec1f-b751-411c-a257-1443a5fb9379.filesusr.com/ugd/238140_1348e08c978247b6a824316b926a32c7.pdf?index=true
• https://da2848bb-f6be-4809-8ec5-cfead36af8bb.filesusr.com/ugd/7f46b5_13bca9ebf1884ddf8f772bc380388ab7.pdf?index=true
• https://414a654d-c4cc-4cf1-b457-ed52f9042c43.filesusr.com/ugd/5b5da7_ce132913a64c4f3ab22e95c47cfa942d.pdf?index=true
• https://a3de5abb-b8e3-477f-95df-ca3bee7f291e.filesusr.com/ugd/ef0078_d00146b3acff46568ce7d9e1ba0e0ff9.pdf?index=true
• https://10fb71f5-d8d8-43c8-91a8-c65b771ac41d.filesusr.com/ugd/3be3a7_76d9cca6391048e5b9da01958908d646.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• 3d3a4c52-6eb8-48da-8813-3b36050d01d5.filesusr.com
• 4185ba4b-8c55-4116-9701-315948ae89cd.filesusr.com
• 67ee0e26-eb75-43ed-9a21-34b09e35fde3.filesusr.com
• 99f14fe3-e99a-40b8-9446-e3faef6adb36.filesusr.com
• 817153ab-3ffd-424d-9095-ab8abf8483c6.filesusr.com
• zalozixuv.caavd.ca
• vapizu.canadiancoachbaker.com
• files.panasiatourist.com
• vemazigex.georgepritchard.com
• files.vocesintimaeartsong.com
• cdn.shopify.com
• bef7ec1f-b751-411c-a257-1443a5fb9379.filesusr.com
• da2848bb-f6be-4809-8ec5-cfead36af8bb.filesusr.com
• 414a654d-c4cc-4cf1-b457-ed52f9042c43.filesusr.com
• a3de5abb-b8e3-477f-95df-ca3bee7f291e.filesusr.com
• 10fb71f5-d8d8-43c8-91a8-c65b771ac41d.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report