MALICIOUS — 99b222_ee7049eb46e5446da76c239ee04f479d.pdf

MALICIOUS — 99b222_ee7049eb46e5446da76c239ee04f479d.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: c4b5574254c84f62152340b0cab787299902eefa806f849c82dbeb9099018e63
• SHA-1: a6c7ba714d909f6f74f1a9b9ee98324d3ba6fb61
• MD5: 8dbde85190d1dc5af02cb9948c04252e
• ssdeep: 1536:zGFn7chF3lYv01YDxBw8nRg2ivtjncCgd:CFnoPlYM1YDxjBQgB
• TLSH: T1B234ADF3589BED8C3A86AB03A9E701596145D34C3137AB1049DD7B7CE17C6BDAE108A0
• Submitted as: 99b222_ee7049eb46e5446da76c239ee04f479d.pdf
• File type: pdf · Size: 56517 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=weslo+cadence+g40+treadmill+price, https://cdn.shopify.com/s/files/1/0463/0393/6669/files/poe_syndicate_farming_guide.pdf, https://cdn.shopify.com/s/files/1/0427/8052/4710/files/fedujegiboxe.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=weslo+cadence+g40+treadmill+price
• https://cdn.shopify.com/s/files/1/0463/0393/6669/files/poe_syndicate_farming_guide.pdf
• https://cdn.shopify.com/s/files/1/0427/8052/4710/files/fedujegiboxe.pdf
• https://cdn.shopify.com/s/files/1/0462/3633/6282/files/redexuwegedunopuguv.pdf
• https://cdn.shopify.com/s/files/1/0432/5956/0086/files/84601376295.pdf
• https://cdn.shopify.com/s/files/1/0430/1360/3491/files/28588658983.pdf
• http://dikawox.hopefulplace.com/uploads/1/3/1/6/131636725/jawetebejaliz_wiwilujogepoxib_ruzazafe.pdf
• http://files.msport6.com/uploads/1/3/0/7/130775352/vebugu.pdf
• http://files.bsa-sccc-pack301.com/uploads/1/3/1/1/131164476/faxiropem.pdf
• https://2876c6c4-0c10-4707-b497-c6d2512ccb34.filesusr.com/ugd/c8df25_234eca12a1624b1daf1e69b1f2fd2438.pdf?index=true
• https://d848854e-87c2-4993-a9ca-a9fed871e84d.filesusr.com/ugd/2c608b_5f52f8885508441aad91be544d5084e4.pdf?index=true
• https://144dd961-ab3b-4b5f-a036-b73fb9695ffb.filesusr.com/ugd/7a359d_bfd49d8b34924233b7fc5bea7689fd3a.pdf?index=true
• https://80992133-6a73-4002-88b8-afa4a0fa18ee.filesusr.com/ugd/21a131_e0fdbcdd31c046068c5de39cc6e841bc.pdf?index=true
• https://d9e7fcaf-a19d-4752-9442-362e74173b30.filesusr.com/ugd/3f8d85_147d77f8de45475e9433d4804566b88c.pdf?index=true
• https://cdn.shopify.com/s/files/1/0428/9835/8432/files/16711599054.pdf
• https://cdn.shopify.com/s/files/1/0431/3382/9271/files/acellus_answer_key_english_10.pdf
• https://cdn.shopify.com/s/files/1/0429/5743/9129/files/4271300126.pdf
• https://cdn.shopify.com/s/files/1/0460/0535/4657/files/email_signature_template_free_psd.pdf
• https://cdn.shopify.com/s/files/1/0438/3113/2322/files/grow_rpg_walkthough.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• cdn.shopify.com
• dikawox.hopefulplace.com
• files.msport6.com
• files.bsa-sccc-pack301.com
• 2876c6c4-0c10-4707-b497-c6d2512ccb34.filesusr.com
• d848854e-87c2-4993-a9ca-a9fed871e84d.filesusr.com
• 144dd961-ab3b-4b5f-a036-b73fb9695ffb.filesusr.com
• 80992133-6a73-4002-88b8-afa4a0fa18ee.filesusr.com
• d9e7fcaf-a19d-4752-9442-362e74173b30.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report