MALICIOUS — b444d4_600e27fbf8204480ac63af137d9ca7ec.pdf

MALICIOUS — b444d4_600e27fbf8204480ac63af137d9ca7ec.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: ced31adfd2d09e61e85cc6593da54ed5d19bc3e3491196e7fd8c1ba12e7d6db1
• SHA-1: 821ea159b5a488a420a0ef8c66d2ed1634db5451
• MD5: 95fc206203b44042824c47896cfacb37
• ssdeep: 768:QgGzpDxiGbBkEfhDS9HbBiB7uxLfi9Imc3NbMLyzD8R4ZSX:9GFdPSpbS7CLq9ImONbpz4R4ZSX
• TLSH: T1BA32AEF71063ED8D7ACA9B036DA6109E5445D78CA13366A01ACC3B3CC9786FDBE14921
• Submitted as: b444d4_600e27fbf8204480ac63af137d9ca7ec.pdf
• File type: pdf · Size: 43777 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=angry+birds+epic+mod+apk%252Bdata+%2528unlimited+gold%252Fgems%2529, http://valetol.jonathanjawilson.com/uploads/1/3/1/4/131483830/vejotulo.pdf, http://files.senatorscycling.org/uploads/1/3/0/7/130739147/6015718.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=angry+birds+epic+mod+apk%252Bdata+%2528unlimited+gold%252Fgems%2529
• http://valetol.jonathanjawilson.com/uploads/1/3/1/4/131483830/vejotulo.pdf
• http://files.senatorscycling.org/uploads/1/3/0/7/130739147/6015718.pdf
• http://files.woodenshoeauction.com/uploads/1/3/2/6/132682899/dc203b8eb.pdf
• https://cdn.shopify.com/s/files/1/0433/6061/6599/files/xajusolipag.pdf
• https://d275e114-0aaa-4904-83d0-756ea250833a.filesusr.com/ugd/7baf93_248e9eb8531b49e6963c829b29e2ac4f.pdf?index=true
• https://25b87602-5db0-416b-ba94-e25c7f0a9d70.filesusr.com/ugd/b50c55_e5aa0e018be14e4bb1e6c959871d63fe.pdf?index=true
• https://4e46b508-ab36-4a2b-8f26-cacb28f2b3ef.filesusr.com/ugd/e745be_93ccbfcf591c4d4d8ca2d96af0155844.pdf?index=true
• https://754d046f-480b-449d-b62a-9f935220b586.filesusr.com/ugd/1acd69_dfb56a06d43c4d91b4a3ed488989fff4.pdf?index=true
• https://cdn.shopify.com/s/files/1/0434/1497/8718/files/11660788387.pdf
• https://cdn.shopify.com/s/files/1/0434/4443/7142/files/25017535029.pdf
• https://cdn.shopify.com/s/files/1/0429/0599/3375/files/tuvugejokaliropagixim.pdf
• https://cdn.shopify.com/s/files/1/0437/2715/9445/files/31022495847.pdf
• https://cdn.shopify.com/s/files/1/0430/5770/9210/files/dinuviz.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• valetol.jonathanjawilson.com
• files.senatorscycling.org
• files.woodenshoeauction.com
• cdn.shopify.com
• d275e114-0aaa-4904-83d0-756ea250833a.filesusr.com
• 25b87602-5db0-416b-ba94-e25c7f0a9d70.filesusr.com
• 4e46b508-ab36-4a2b-8f26-cacb28f2b3ef.filesusr.com
• 754d046f-480b-449d-b62a-9f935220b586.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report