MALICIOUS — 89441e_0b5032df08804dfaa20e6659536d4506.pdf

MALICIOUS — 89441e_0b5032df08804dfaa20e6659536d4506.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: d789c8d650d0b65e40c25e9a8771082cb6ac4981d1fda390b99abf91eae48af6
• SHA-1: f8b777ae18c8e3d3f1c4fe303919078c8beb6097
• MD5: 1b25a79ad5def4adc51d5dade9bf9b91
• ssdeep: 384:BsFlS3K6XgKV7cAgdOpW+008B42es+lwJzemFeSjHUag0gIIqLJjmYH1e30V3lCa:lgGzpD7cDw2IyJjflVfway/zr3WQ1Y
• TLSH: T19E308CF7A497DC8C6987AB13A8D20059A086C6886133E77008CD7B6DC4BC2FDAF50975
• Submitted as: 89441e_0b5032df08804dfaa20e6659536d4506.pdf
• File type: pdf · Size: 36487 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=scion+tc+turbo+kit, http://getosa.wekeepyoumotivated.com/uploads/1/3/0/7/130739287/6037708.pdf, http://xexiwafu.frompapagod.com/uploads/1/3/1/4/131406286/1215152.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=scion+tc+turbo+kit
• http://getosa.wekeepyoumotivated.com/uploads/1/3/0/7/130739287/6037708.pdf
• http://xexiwafu.frompapagod.com/uploads/1/3/1/4/131406286/1215152.pdf
• http://files.alexisarenas.com/uploads/1/3/1/8/131858916/wagabizuwenesiv-gapumamomav.pdf
• http://files.boavitnutrition.com/uploads/1/3/2/6/132681156/6830158.pdf
• https://8373f743-767a-48a4-bb4f-4031e8e7dec0.filesusr.com/ugd/e6092c_bff3d8b4cf4547f6b0c203273b35f8b9.pdf?index=true
• https://48dda493-8ef9-4997-b72b-199321e0ceb5.filesusr.com/ugd/277b62_5f0d2bae7b2840248493f073424da50a.pdf?index=true
• https://5b33fb98-1ad8-45f1-81d0-25cfeadb220d.filesusr.com/ugd/76156b_d39dcded2a794834a969a611dcb077ae.pdf?index=true
• http://files.orbhoa.com/uploads/1/3/1/4/131408537/bemipatoret.pdf
• http://files.saintlouisspeed.com/uploads/1/3/0/7/130775245/247f66ad4a97d.pdf
• https://9268c45a-4549-474b-b689-2fbf6df981b8.filesusr.com/ugd/2e4eb4_c9fbba7d72ef4418bf502f6cc007ff72.pdf?index=true
• https://7e966814-f776-4151-a480-b546ff034d6c.filesusr.com/ugd/43d598_cfd6598f285440b5825c8a2d5bd9260b.pdf?index=true
• https://6e60da49-bc5e-49e9-9a2c-88ccfd132906.filesusr.com/ugd/237bf7_d07709e9e67d4d41a4bfdd547feb90ad.pdf?index=true
• https://414a654d-c4cc-4cf1-b457-ed52f9042c43.filesusr.com/ugd/5b5da7_ce132913a64c4f3ab22e95c47cfa942d.pdf?index=true
• https://7170d7ea-6863-4b3f-93b8-6fd63f013c93.filesusr.com/ugd/d4579c_2108f4ba561b4e3fb0f88dbd0d1b4b97.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• getosa.wekeepyoumotivated.com
• xexiwafu.frompapagod.com
• files.alexisarenas.com
• files.boavitnutrition.com
• 8373f743-767a-48a4-bb4f-4031e8e7dec0.filesusr.com
• 48dda493-8ef9-4997-b72b-199321e0ceb5.filesusr.com
• 5b33fb98-1ad8-45f1-81d0-25cfeadb220d.filesusr.com
• files.orbhoa.com
• files.saintlouisspeed.com
• 9268c45a-4549-474b-b689-2fbf6df981b8.filesusr.com
• 7e966814-f776-4151-a480-b546ff034d6c.filesusr.com
• 6e60da49-bc5e-49e9-9a2c-88ccfd132906.filesusr.com
• 414a654d-c4cc-4cf1-b457-ed52f9042c43.filesusr.com
• 7170d7ea-6863-4b3f-93b8-6fd63f013c93.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report