MALICIOUS — db80c5_73116cb0a7f643ec857ab8afa799de52.pdf

MALICIOUS — db80c5_73116cb0a7f643ec857ab8afa799de52.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: e417ff4f9399bbde64310b4e309caa2a558bfae6ac29ecd58b7eaaf3e4775aa7
• SHA-1: 8ca22e7f64f621c52b8a3b446b9e853fb6a3368e
• MD5: e9e3e8b20b4c14fd3ebb42ee4bf4c3fc
• ssdeep: 768:PgGzpDgY7jTIWvfz7ldVC5+YJdsftccxlIP2WllZJkeaEdZp:4GFcYMWD77VCFJ6cke2WvmEdZp
• TLSH: T18233AFF301E7ED8C698E6B03A9A71458B086D3CE723295A444DC777CC4786EDAF11A21
• Submitted as: db80c5_73116cb0a7f643ec857ab8afa799de52.pdf
• File type: pdf · Size: 51735 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=rainbow+text+photoshop, http://jupemap.davidjrose.com/uploads/1/3/1/4/131407045/1434062.pdf, http://jaxubaral.stefankutsarov.com/uploads/1/3/2/3/132302978/7687251.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=rainbow+text+photoshop
• http://jupemap.davidjrose.com/uploads/1/3/1/4/131407045/1434062.pdf
• http://jaxubaral.stefankutsarov.com/uploads/1/3/2/3/132302978/7687251.pdf
• http://files.sophisticatedpress.com/uploads/1/3/1/3/131398475/4259040.pdf
• http://files.enakosovac.com/uploads/1/3/0/7/130739275/61442ae02cac69.pdf
• https://522a37b9-80e8-43e0-87fc-e75aecc322a6.filesusr.com/ugd/031dda_cb66a9c0cc184c88bc0d1572ac7347e6.pdf?index=true
• https://07713480-4b5b-46a5-9aac-b0a84ec6cac0.filesusr.com/ugd/696117_101742c6041f4dbbb17daf4dc7fe06a9.pdf?index=true
• https://fc1b8cf9-1847-4df1-93aa-a7d49c0e174a.filesusr.com/ugd/1d5a3f_bcf4b58ee7dd49a3954e7ad545c4347a.pdf?index=true
• https://b7bf410d-0c46-48f4-a7cd-db7a3fd2072f.filesusr.com/ugd/5899d5_1f3c493303a548159b8a37fb14cc3e10.pdf?index=true
• https://09fd2d5d-ba76-4a45-959b-e472f05e3bfd.filesusr.com/ugd/bdc04d_8520a6474e394a1880ee91238cfa69b4.pdf?index=true
• https://02014a04-9706-4c5e-9c30-8e861345e0cb.filesusr.com/ugd/d90490_fe273fa5d1e54b06aa730a1aa8abfcc6.pdf?index=true
• https://d034e770-9586-4878-ba1f-9acd06ecbab3.filesusr.com/ugd/ea2f88_7231f50e0504442e857960dad6d6bada.pdf?index=true
• https://f3a5f1f3-ef31-46cb-b19d-a67ce7d903cf.filesusr.com/ugd/11b39a_e60c03c4ef544cc9aab5bce1b97d2715.pdf?index=true
• https://8dd4a27b-d756-4eea-8b34-5178e5184771.filesusr.com/ugd/d9f7b5_e91016de6240488195ea2b2a92c77dd9.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• jupemap.davidjrose.com
• jaxubaral.stefankutsarov.com
• files.sophisticatedpress.com
• files.enakosovac.com
• 522a37b9-80e8-43e0-87fc-e75aecc322a6.filesusr.com
• 07713480-4b5b-46a5-9aac-b0a84ec6cac0.filesusr.com
• fc1b8cf9-1847-4df1-93aa-a7d49c0e174a.filesusr.com
• b7bf410d-0c46-48f4-a7cd-db7a3fd2072f.filesusr.com
• 09fd2d5d-ba76-4a45-959b-e472f05e3bfd.filesusr.com
• 02014a04-9706-4c5e-9c30-8e861345e0cb.filesusr.com
• d034e770-9586-4878-ba1f-9acd06ecbab3.filesusr.com
• f3a5f1f3-ef31-46cb-b19d-a67ce7d903cf.filesusr.com
• 8dd4a27b-d756-4eea-8b34-5178e5184771.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report