MALICIOUS — 5926b4_6df518d280414e32a983647e7e8910a5.pdf

MALICIOUS — 5926b4_6df518d280414e32a983647e7e8910a5.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: d25d36caed872e88fe5609d947b8e237382ced47816d5d393f476b92bcf104e2
• SHA-1: e8da3a0198aaf6b943cb183fcd06c0b5f0df41df
• MD5: 7c919456849abf523c700d6f7a7b09b8
• ssdeep: 768:WgGzpDdov15TaOmINq/DwWzPOhv4ueYcnMZK8XTfZsPlkqG0CKDM92PLYe+j+jZ:DGFZkvPNeXPOVsP+sCRj+jZ
• TLSH: T1CC33AFF311EFEE8C6986DB43B5AA2429A186D7885073AA7505C83B3CC47C37D7E10951
• Submitted as: 5926b4_6df518d280414e32a983647e7e8910a5.pdf
• File type: pdf · Size: 48127 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=roblox+mod+apk+unlimited+robux+2019+download+latest+version, http://files.responseplumber.ca/uploads/1/3/1/1/131163620/69f1c228.pdf, http://dofijas.tiffanyhuertas.com/uploads/1/3/1/3/131381839/43b8dcc997a8729.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=roblox+mod+apk+unlimited+robux+2019+download+latest+version
• http://files.responseplumber.ca/uploads/1/3/1/1/131163620/69f1c228.pdf
• http://dofijas.tiffanyhuertas.com/uploads/1/3/1/3/131381839/43b8dcc997a8729.pdf
• http://files.authormichaelduncan.com/uploads/1/3/1/4/131437862/vagenemifenifob.pdf
• http://sapovif.apartmentdeals.com/uploads/1/3/1/0/131070852/zemoxadada.pdf
• http://files.namifarnorth.org/uploads/1/3/1/4/131453111/bc478430144ce58.pdf
• http://files.castrovilleconservationsociety.net/uploads/1/3/1/6/131606115/3836910.pdf
• http://files.mainternational.net/uploads/1/3/1/4/131438419/diluva.pdf
• https://cdn.shopify.com/s/files/1/0434/8156/3286/files/96394077724.pdf
• https://cdn.shopify.com/s/files/1/0428/6837/5719/files/winef.pdf
• https://cdn.shopify.com/s/files/1/0445/1749/0847/files/batob.pdf
• https://cdn.shopify.com/s/files/1/0439/0571/2296/files/expanded_polystyrene_sheets_suppliers.pdf
• https://cdn.shopify.com/s/files/1/0435/3759/6580/files/tv_guide_newcastle_nsw_australia.pdf
• https://cdn.shopify.com/s/files/1/0427/8052/4710/files/lekulorosurejixe.pdf
• https://cdn.shopify.com/s/files/1/0435/6161/5519/files/degesamuk.pdf
• https://cdn.shopify.com/s/files/1/0469/0349/2768/files/16420865987.pdf
• https://cdn.shopify.com/s/files/1/0440/1856/5270/files/tapipo.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• files.responseplumber.ca
• dofijas.tiffanyhuertas.com
• files.authormichaelduncan.com
• sapovif.apartmentdeals.com
• files.namifarnorth.org
• files.castrovilleconservationsociety.net
• files.mainternational.net
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report