MALICIOUS — 0bfb20_71f2ecdb83944a7ca49ae31330ffaa86.pdf

MALICIOUS — 0bfb20_71f2ecdb83944a7ca49ae31330ffaa86.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: d65b7d634e26c28b6e50ae38b718b1afb5202656ad23f21b84b6843e5adc8831
• SHA-1: 88da30ff9c9955e2665b5b03436d0aa6ab26f6ae
• MD5: 87f2bd842416092b454fdf1ac2c756b4
• ssdeep: 768:lgGzpDI1VRz7/9ofbI5+yd+UBRFFdb5gKhI+S4ROtyZRDO4VI+I:2GFE1vfKf0wyd+U5db5gKhIbtynO4VIj
• TLSH: T191339EF360E7ED4C7B8E6B0B9EEA2159608AD3886136526045CC7B3CC47C6BC6F50A51
• Submitted as: 0bfb20_71f2ecdb83944a7ca49ae31330ffaa86.pdf
• File type: pdf · Size: 48023 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=pathfinder+grapple+feats, https://a64a8d9b-32ab-44ac-81c7-ec60a8a065c4.filesusr.com/ugd/e948c1_c68b5e15518c4ff6b6845a18066f52eb.pdf?index=true, https://20b9e500-50e7-40a5-b083-377b03538968.filesusr.com/ugd/724fb5_c439e2f7431e4df4bbe66a6888fb17db.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=pathfinder+grapple+feats
• https://a64a8d9b-32ab-44ac-81c7-ec60a8a065c4.filesusr.com/ugd/e948c1_c68b5e15518c4ff6b6845a18066f52eb.pdf?index=true
• https://20b9e500-50e7-40a5-b083-377b03538968.filesusr.com/ugd/724fb5_c439e2f7431e4df4bbe66a6888fb17db.pdf?index=true
• https://2fe1dc0b-0f3e-4c77-ac68-12b804c0357a.filesusr.com/ugd/cc089a_79741ed2507642f79682960c4a06138d.pdf?index=true
• https://8d7303db-7d70-440b-9318-30a6bd508c34.filesusr.com/ugd/dcf311_1ab88dd46091497b80630e4f9f1be705.pdf?index=true
• https://4237918c-70c2-4790-9c40-8e6be840c3b8.filesusr.com/ugd/8b9728_fb4aea886eba4a9aa5a45e0d70588d15.pdf?index=true
• http://nogomedax.nicholasbjacobsen.com/uploads/1/3/1/3/131398274/7705500.pdf
• http://files.ken-lab.com/uploads/1/3/0/7/130776861/869194.pdf
• http://rivewif.flowersbyjaga.com/uploads/1/3/1/0/131071145/80ee8120eca1.pdf
• http://files.midpointconstructioninc.com/uploads/1/3/0/7/130740072/09e3d999.pdf
• http://files.nextcow.com/uploads/1/3/0/7/130775286/lumadakilopeb-sapib-dogaze.pdf
• http://files.roscoebarnes.net/uploads/1/3/0/8/130874295/1593216.pdf
• http://kuzavazat.benzprograms.com/uploads/1/3/1/3/131379421/tomojuxugel_xazunisoxupik_gamozun.pdf
• http://files.nt-drisc.org/uploads/1/3/0/9/130969717/986416.pdf
• http://files.gordonwalkerconsulting.com/uploads/1/3/1/4/131483027/c0169ec067773d.pdf
• https://2ee1f39c-750d-48b2-84ad-c0ac589524ac.filesusr.com/ugd/12745a_bb48f4313c224b9f8e4cc03412bd5d89.pdf?index=true
• https://a0803403-2a7e-4a62-aa74-dfd64c85c36e.filesusr.com/ugd/a891c0_d1901772d5154ab8873c3ee7cfb8c9e7.pdf?index=true
• https://278a8685-c9e2-411b-bdfb-ad2d8a7617fb.filesusr.com/ugd/29c71c_4c6094611eac438397e356e9e2ac2151.pdf?index=true
• https://aa9317f3-2d7d-4b30-a693-76b2b5b1ebde.filesusr.com/ugd/60ffa2_eae38858aca54ae0afa6f932d91c3a5a.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• a64a8d9b-32ab-44ac-81c7-ec60a8a065c4.filesusr.com
• 20b9e500-50e7-40a5-b083-377b03538968.filesusr.com
• 2fe1dc0b-0f3e-4c77-ac68-12b804c0357a.filesusr.com
• 8d7303db-7d70-440b-9318-30a6bd508c34.filesusr.com
• 4237918c-70c2-4790-9c40-8e6be840c3b8.filesusr.com
• nogomedax.nicholasbjacobsen.com
• files.ken-lab.com
• rivewif.flowersbyjaga.com
• files.midpointconstructioninc.com
• files.nextcow.com
• files.roscoebarnes.net
• kuzavazat.benzprograms.com
• files.nt-drisc.org
• files.gordonwalkerconsulting.com
• 2ee1f39c-750d-48b2-84ad-c0ac589524ac.filesusr.com
• a0803403-2a7e-4a62-aa74-dfd64c85c36e.filesusr.com
• 278a8685-c9e2-411b-bdfb-ad2d8a7617fb.filesusr.com
• aa9317f3-2d7d-4b30-a693-76b2b5b1ebde.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report