MALICIOUS — f390e7_0ef28662976c4175b4202fccd913f642.pdf

MALICIOUS — f390e7_0ef28662976c4175b4202fccd913f642.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: d6b85992e05f5ba4e7bbc19debc781d3e2a67e762764569b958717484a16115c
• SHA-1: 9bf5dfa4a6bd032883e4d3d9c3e3898c959694e5
• MD5: c77e34e09642df2b5a7d91193ff4aecf
• ssdeep: 768:qgGzpDRbBf70u0v1l60ZRmsifcLzd8P/xmujjMsrEBRI:3GFtOZtwcLR8P/xmqgsrEBRI
• TLSH: T195328DF34167ED4C3A879743ACAB1195608A878C7232EB6415C9B76CC47C1BDBF90960
• Submitted as: f390e7_0ef28662976c4175b4202fccd913f642.pdf
• File type: pdf · Size: 45676 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=chamberlain+clicker+keypad+programming+instructions, http://vofenu.bandorlando.com/uploads/1/3/0/9/130969339/7982070.pdf, http://files.thelmaandnate.com/uploads/1/3/1/4/131438814/6c0c3da8a7.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=chamberlain+clicker+keypad+programming+instructions
• http://vofenu.bandorlando.com/uploads/1/3/0/9/130969339/7982070.pdf
• http://files.thelmaandnate.com/uploads/1/3/1/4/131438814/6c0c3da8a7.pdf
• http://giweme.stevemacspics.com/uploads/1/3/0/8/130814328/6611546.pdf
• http://files.therocdweller.org/uploads/1/3/2/6/132682936/1231350.pdf
• https://cdn.shopify.com/s/files/1/0430/0505/1029/files/38862329235.pdf
• https://cdn.shopify.com/s/files/1/0432/3534/4539/files/49240289469.pdf
• https://cdn.shopify.com/s/files/1/0434/2566/1095/files/wirokoworimuvupewixumu.pdf
• http://lededo.breen.shop/uploads/1/3/2/6/132681865/2111061.pdf
• http://gufupizuv.mirandaraecarter.com/uploads/1/3/0/7/130739227/jajivinolub.pdf
• http://zozig.motivatedqueen.com/uploads/1/3/0/8/130813528/budofafutiwe.pdf
• http://files.megabiteschocolate.com/uploads/1/3/1/4/131437880/dacd7c19318e.pdf
• http://files.chambleecharterhighschooljrotc.com/uploads/1/3/1/4/131406036/donelofuwelid.pdf
• https://cdn.shopify.com/s/files/1/0432/6316/4580/files/brown_v_kendall_procedural_history.pdf
• https://cdn.shopify.com/s/files/1/0431/4018/6279/files/82356229252.pdf
• https://cdn.shopify.com/s/files/1/0429/5560/4124/files/60889799513.pdf
• https://cdn.shopify.com/s/files/1/0431/9795/6256/files/55503836117.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• vofenu.bandorlando.com
• files.thelmaandnate.com
• giweme.stevemacspics.com
• files.therocdweller.org
• cdn.shopify.com
• lededo.breen.shop
• gufupizuv.mirandaraecarter.com
• zozig.motivatedqueen.com
• files.megabiteschocolate.com
• files.chambleecharterhighschooljrotc.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report