MALICIOUS — bc0b97_f9d30d2c6fa84d1eadcd91cf3a7e246e.pdf

MALICIOUS — bc0b97_f9d30d2c6fa84d1eadcd91cf3a7e246e.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: d9adc76094dcd6894dc5f5b5646d066966c1777f38b374857ae49c28ebf6b494
• SHA-1: ea9d76218c274ed2f798b7825f148111ff297008
• MD5: eaf2362a9beff0b50f337916984f84a9
• ssdeep: 768:DgGzpDM6hGocP+oKRiM2BnXpxU/JxnjpcY3VZdUxsl8OE4WIKZ/8I2:8GFoJ7UNcGdUrOEVZUI2
• TLSH: T12130AEF3405BED8C7AC5AB037DEA105A914AD68C3023A69408D97B2CD4787FC6E55A31
• Submitted as: bc0b97_f9d30d2c6fa84d1eadcd91cf3a7e246e.pdf
• File type: pdf · Size: 38659 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=bone+fracture+worksheet+answer+key, http://wujudi.we-holidays.com/uploads/1/3/1/4/131406226/5580549.pdf, http://xotonel.capecodpoetryreview.com/uploads/1/3/0/7/130739430/34e4b25362.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=bone+fracture+worksheet+answer+key
• http://wujudi.we-holidays.com/uploads/1/3/1/4/131406226/5580549.pdf
• http://xotonel.capecodpoetryreview.com/uploads/1/3/0/7/130739430/34e4b25362.pdf
• http://ranama.horsey-hemp.com/uploads/1/3/0/7/130739897/xujixukimase.pdf
• http://buxitisow.stmaryslibrary.org/uploads/1/3/0/8/130813714/wotakatanosaze.pdf
• https://cdn.shopify.com/s/files/1/0432/4635/4594/files/tugazidaxu.pdf
• https://cdn.shopify.com/s/files/1/0432/5372/7394/files/project_communications_plan_template.pdf
• https://cdn.shopify.com/s/files/1/0437/2194/9335/files/seguludajagesudov.pdf
• https://cdn.shopify.com/s/files/1/0433/4131/6264/files/64768667487.pdf
• https://cdn.shopify.com/s/files/1/0432/4071/8496/files/85567763800.pdf
• https://cdn.shopify.com/s/files/1/0461/9065/7687/files/photoshop_cs5_full_crack_2018.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• wujudi.we-holidays.com
• xotonel.capecodpoetryreview.com
• ranama.horsey-hemp.com
• buxitisow.stmaryslibrary.org
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report