MALICIOUS — 93c935_f6a0654bf4b24affa415a030e61560dc.pdf

MALICIOUS — 93c935_f6a0654bf4b24affa415a030e61560dc.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: d16d15e6397e9a55ceb5e5a6ca62753ec1560181b52cd064468ecc501be01c44
• SHA-1: b7ec264677ca183371ebce02a87246fd8b2d293b
• MD5: 67c574b49a5b52029f10aba16bb36ab2
• ssdeep: 768:YgGzpDPyM1werRHsvsDB8CvEWX70jmIVDSTBm9gakkENlvv:1GFb4UPDoE0HVG98kkQlvv
• TLSH: T1F9309DF394DBED8C7EC79B03ADA20455648AC6C9613397741898372DC8BC6BCAF50920
• Submitted as: 93c935_f6a0654bf4b24affa415a030e61560dc.pdf
• File type: pdf · Size: 38539 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=eulis+the+history+of+love+pdf, http://zirex.tilleyrent.com/uploads/1/3/0/8/130814297/8975498.pdf, http://bokun.amychally.com/uploads/1/3/1/0/131070054/5bf6d8e240.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=eulis+the+history+of+love+pdf
• http://zirex.tilleyrent.com/uploads/1/3/0/8/130814297/8975498.pdf
• http://bokun.amychally.com/uploads/1/3/1/0/131070054/5bf6d8e240.pdf
• http://files.ohiomorganhorse.com/uploads/1/3/1/4/131437725/guxer.pdf
• http://files.thelightingsummit.com/uploads/1/3/1/6/131637136/56f2241d.pdf
• http://files.peacememorialauditorium.org/uploads/1/3/1/4/131483148/nigazuzetiruvabu.pdf
• http://files.luzelenacastro.com/uploads/1/3/1/4/131408798/afdd3b9728ce8.pdf
• https://ed07e108-49f9-4aeb-9997-855ec824ffbc.filesusr.com/ugd/d5cf39_b718f68743d1430485b4f28f79f9e901.pdf?index=true
• https://20934f9a-30f6-4996-b5af-4639fcb736b3.filesusr.com/ugd/29c71c_18587ebd6b4f4da9aea9a748962a3f9e.pdf?index=true
• https://a56fe6c0-a7a1-4de6-97e0-f2f3cc50daaa.filesusr.com/ugd/29c71c_737f4da4742b4611ac7693c7e9f59c2c.pdf?index=true
• https://cc1fef2c-e45b-4c57-be01-c6ec839808a0.filesusr.com/ugd/17ce20_d1499a6abcbf40abb43c7a8c4c1b0e0e.pdf?index=true
• https://32a4f822-3f89-450d-805c-c3332d192162.filesusr.com/ugd/5f226b_abbf2cca9aba4bb8827640b9fc972b63.pdf?index=true
• https://9a1af4ee-aafd-4748-b864-bdadfac23356.filesusr.com/ugd/9d869b_eddda5d29bcc418db79cdb99381493c7.pdf?index=true
• https://15334e69-21ec-4eff-8232-675718f0366e.filesusr.com/ugd/b1b3ad_06c63e0f78034d1cac3e7841771b0619.pdf?index=true
• https://2fe390de-72b7-4b0f-a23e-c7b661802f2d.filesusr.com/ugd/3225da_d330100ee45c40bca38a6aa3770baa31.pdf?index=true
• https://450e13dc-ad72-4f44-b59b-1c6a7b952725.filesusr.com/ugd/69695d_77bfeadee0524cf49f35ba2e8a34d302.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• zirex.tilleyrent.com
• bokun.amychally.com
• files.ohiomorganhorse.com
• files.thelightingsummit.com
• files.peacememorialauditorium.org
• files.luzelenacastro.com
• ed07e108-49f9-4aeb-9997-855ec824ffbc.filesusr.com
• 20934f9a-30f6-4996-b5af-4639fcb736b3.filesusr.com
• a56fe6c0-a7a1-4de6-97e0-f2f3cc50daaa.filesusr.com
• cc1fef2c-e45b-4c57-be01-c6ec839808a0.filesusr.com
• 32a4f822-3f89-450d-805c-c3332d192162.filesusr.com
• 9a1af4ee-aafd-4748-b864-bdadfac23356.filesusr.com
• 15334e69-21ec-4eff-8232-675718f0366e.filesusr.com
• 2fe390de-72b7-4b0f-a23e-c7b661802f2d.filesusr.com
• 450e13dc-ad72-4f44-b59b-1c6a7b952725.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report