MALICIOUS — 8a4248_0e67667ac22c487d91c9767c6fbc3f6d.pdf

MALICIOUS — 8a4248_0e67667ac22c487d91c9767c6fbc3f6d.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: c5bfff52eabaa5f47f07d3e19e7ab29e4580b563db9d51ae5cc0ad99c8e9e406
• SHA-1: 37bbd2442516fe4739cc525624ced8ae4ffd2a7c
• MD5: 1be4b8de3b1f63eea3f15525bb449ef1
• ssdeep: 768:/gGzpDLfF1lIBKWbxN2v0u7vqOEmCUfjiUPO+Hp6baB8AJYHeAmLQYsYT:IGF3fUsWKpfjxPOSp1BVY+/sYsYT
• TLSH: T1AD307EF75097FC8C368F9B03AAAA124D108AD689A132A66048DC767CC47C6FD6F10965
• Submitted as: 8a4248_0e67667ac22c487d91c9767c6fbc3f6d.pdf
• File type: pdf · Size: 36035 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=jeppesen+flight+instructor+manual, https://cdn.shopify.com/s/files/1/0433/0687/7080/files/69865881622.pdf, https://cdn.shopify.com/s/files/1/0428/3927/7734/files/lord_of_the_flies_audio.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=jeppesen+flight+instructor+manual
• https://cdn.shopify.com/s/files/1/0433/0687/7080/files/69865881622.pdf
• https://cdn.shopify.com/s/files/1/0428/3927/7734/files/lord_of_the_flies_audio.pdf
• https://cdn.shopify.com/s/files/1/0435/8235/7663/files/alliedbarton_employee_handbook.pdf
• https://cdn.shopify.com/s/files/1/0475/8863/8876/files/security_alarm_ringtone_free.pdf
• https://cdn.shopify.com/s/files/1/0434/5217/0406/files/84649781434.pdf
• http://files.mickkleijwegt.com/uploads/1/3/1/3/131383892/divivu_barokuvunag.pdf
• http://sogawe.xtremeie.com/uploads/1/3/1/0/131070678/7737569.pdf
• https://6b1c1404-0863-4c3f-b3bd-7082b1e290d9.filesusr.com/ugd/8a9bcc_93b68a5e298b48d0acde1f3b44b849dd.pdf?index=true
• https://c91c70cf-f2ee-4621-8659-894a1cef40c9.filesusr.com/ugd/db93e9_719abea2bdf7472c9e80c61d2dc3a18f.pdf?index=true
• https://95436cbb-6ba0-40f3-bbf7-3b5b37ff98ca.filesusr.com/ugd/0182ef_4cd773aec1234e169ae048c2c48bc827.pdf?index=true
• https://524752ca-2666-48ad-88f9-131196ad0831.filesusr.com/ugd/36d413_c40ba80e802b476d98ef7c333eb748b1.pdf?index=true
• https://bdbc05c8-b0b4-42e0-a60a-6e8776d878f7.filesusr.com/ugd/69695d_225e59e7426040ae9e9677ec2d1adffb.pdf?index=true
• https://cdn.shopify.com/s/files/1/0438/3703/0560/files/10963058734.pdf
• https://cdn.shopify.com/s/files/1/0435/6974/1983/files/wunamuxixuzagaxusabaj.pdf
• https://cdn.shopify.com/s/files/1/0436/4769/7061/files/sumajemivewebunigiloguwov.pdf
• https://cdn.shopify.com/s/files/1/0463/2828/3291/files/1998_yamaha_grizzly_600_owners_manual.pdf
• https://cdn.shopify.com/s/files/1/0432/7204/4697/files/appendices_in_thesis_sample.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• cdn.shopify.com
• files.mickkleijwegt.com
• sogawe.xtremeie.com
• 6b1c1404-0863-4c3f-b3bd-7082b1e290d9.filesusr.com
• c91c70cf-f2ee-4621-8659-894a1cef40c9.filesusr.com
• 95436cbb-6ba0-40f3-bbf7-3b5b37ff98ca.filesusr.com
• 524752ca-2666-48ad-88f9-131196ad0831.filesusr.com
• bdbc05c8-b0b4-42e0-a60a-6e8776d878f7.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report