MALICIOUS — 29c71c_4c144e43cd374367983c2d5515080354.pdf

MALICIOUS — 29c71c_4c144e43cd374367983c2d5515080354.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: cda3f88891b0b4ee8566a42fbbe22b90548e807fe8aa700dbc71e07a5b92b675
• SHA-1: 61d95b952bd30cee1c607780529fb08aa575ffec
• MD5: 482c2128c4a00e2e9a9d1c8889e7e258
• ssdeep: 768:SgGzpDPOAlngzt9mQ27QXmR0PaCiKNeFbRbZmWtBWx4IAJeqQ:PGFTOAhCillb7fcTAJeqQ
• TLSH: T10931AFF72197FCCD7A96AB0369E60059A14A868E3136D76448C8667CC4786FCBF448B0
• Submitted as: 29c71c_4c144e43cd374367983c2d5515080354.pdf
• File type: pdf · Size: 41568 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=pokemon+sun+and+moon+clothing+guide, http://fegap.arcasdesigns.com/uploads/1/3/0/7/130776659/mafukud.pdf, http://jijuzos.aandksport.com/uploads/1/3/1/3/131380845/a8f54c.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=pokemon+sun+and+moon+clothing+guide
• http://fegap.arcasdesigns.com/uploads/1/3/0/7/130776659/mafukud.pdf
• http://jijuzos.aandksport.com/uploads/1/3/1/3/131380845/a8f54c.pdf
• http://xavaseb.theskinpod.co.uk/uploads/1/3/1/4/131437363/pigilet.pdf
• https://cdn.shopify.com/s/files/1/0438/1959/7981/files/gta_5_lspdfr_callouts_mod.pdf
• https://cdn.shopify.com/s/files/1/0428/9354/1532/files/goniludusefogojuvitifeb.pdf
• https://cdn.shopify.com/s/files/1/0430/3169/1421/files/allocation_methods_in_os.pdf
• https://cdn.shopify.com/s/files/1/0437/4488/6936/files/zoluxukakotoxasixiromozi.pdf
• https://eb3b4484-2d7e-4b56-a228-2bb980f6a8e7.filesusr.com/ugd/3283b0_c198c01e69ba4b48bd3f65676b29025d.pdf?index=true
• https://428d03de-2769-41a0-9f8e-3db3c6c757ae.filesusr.com/ugd/8c0e65_b57243a5028b42af844542727bb0e682.pdf?index=true
• https://cdn.shopify.com/s/files/1/0435/3989/0327/files/51878712211.pdf
• https://cdn.shopify.com/s/files/1/0429/2149/2643/files/hawaii_trivia_questions_and_answers_printable.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• fegap.arcasdesigns.com
• jijuzos.aandksport.com
• xavaseb.theskinpod.co.uk
• cdn.shopify.com
• eb3b4484-2d7e-4b56-a228-2bb980f6a8e7.filesusr.com
• 428d03de-2769-41a0-9f8e-3db3c6c757ae.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report