MALICIOUS — 3be48b_f5fc394af1284cf9a2d1268c24805efd.pdf

MALICIOUS — 3be48b_f5fc394af1284cf9a2d1268c24805efd.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: e547a0a2972817ed908c28caafd2ea771466a33e39ea8b0d835536eeb234f023
• SHA-1: b83fa49106e02fc28c8d16e1065f8fb0083181a1
• MD5: 96d7bcd2aa2d956e7686a0268ff747d2
• ssdeep: 768:IgGzpDI/Lirx7pyI5nLUJi3L9RrEfZfWQ8HKu/+m6wo3fWl6vzBSB/2T:FGFEUFLUMhJUZ+HKg+hwo3fWl6lSB/2T
• TLSH: T17B338DF31097ED4C7B4E5F03AEAB11A86196DA8D7127D65014CCBA6CC07C6FCAE04A61
• Submitted as: 3be48b_f5fc394af1284cf9a2d1268c24805efd.pdf
• File type: pdf · Size: 48641 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=migrate+custom+rom+apk, https://cdn.shopify.com/s/files/1/0432/7158/5952/files/39825457013.pdf, https://cdn.shopify.com/s/files/1/0430/6649/1042/files/71571550914.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=migrate+custom+rom+apk
• https://cdn.shopify.com/s/files/1/0432/7158/5952/files/39825457013.pdf
• https://cdn.shopify.com/s/files/1/0430/6649/1042/files/71571550914.pdf
• https://cdn.shopify.com/s/files/1/0429/3351/8489/files/how_to_highlight_on_ipad_with_apple_pencil.pdf
• https://cdn.shopify.com/s/files/1/0434/5312/0664/files/wirubixalewavigixufipuvi.pdf
• https://b7bf2e5a-2fe4-4805-aa8b-b2b4184e3c37.filesusr.com/ugd/b7ab08_89a1282c85254560bb288f4d87432e2a.pdf?index=true
• https://ba5cde4d-89e7-46d7-a15f-3b000305daa3.filesusr.com/ugd/3be3a7_d100d4bce5fc411aa471de3cc0ae7af9.pdf?index=true
• https://ddb350ef-8636-4f63-958d-d8faad94c264.filesusr.com/ugd/a517f4_961dc86138de4ade84a33735055440df.pdf?index=true
• https://2dbce790-4fa4-44eb-9527-61d561708971.filesusr.com/ugd/158fb9_30927bcd7fa84802860a34ab76507513.pdf?index=true
• http://xexesi.siltsockinstall.net/uploads/1/3/1/6/131637312/bc454b9b.pdf
• http://xamuj.symphoniejeunesse.org/uploads/1/3/1/3/131380600/fejurawapupo.pdf
• http://sedurix.a2acollaborative.org/uploads/1/3/0/9/130968996/6059600.pdf
• http://nigel.hogansmusic.com/uploads/1/3/1/1/131163962/5eff54b4.pdf
• http://xaxowuj.romerolab.com/uploads/1/3/2/3/132302998/sepene.pdf
• https://57e810af-595d-4641-b8f0-b2ff3b8fee86.filesusr.com/ugd/09273f_6527343056e74ce5b7d43645b547f049.pdf?index=true
• https://d2f200e9-2973-451c-8db6-4e32d9d830c0.filesusr.com/ugd/debbe1_fbf4f4b8de474bebb3c7a1c4fabb1d94.pdf?index=true
• https://5d97cd6c-e1c7-4261-b34a-656914277e5a.filesusr.com/ugd/4dded2_aa3d0b1590a8423eacce752aa44c86b7.pdf?index=true
• https://d608444a-2011-4dc5-b23c-ec433273bc8a.filesusr.com/ugd/2d1648_08019c48e1c642d4999421b880b36e8f.pdf?index=true
• https://72777579-9226-4b40-9a3f-98ba75618e9f.filesusr.com/ugd/7f46b5_5f68f60f075e45e6860b269a7a477d0f.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• cdn.shopify.com
• b7bf2e5a-2fe4-4805-aa8b-b2b4184e3c37.filesusr.com
• ba5cde4d-89e7-46d7-a15f-3b000305daa3.filesusr.com
• ddb350ef-8636-4f63-958d-d8faad94c264.filesusr.com
• 2dbce790-4fa4-44eb-9527-61d561708971.filesusr.com
• xexesi.siltsockinstall.net
• xamuj.symphoniejeunesse.org
• sedurix.a2acollaborative.org
• nigel.hogansmusic.com
• xaxowuj.romerolab.com
• 57e810af-595d-4641-b8f0-b2ff3b8fee86.filesusr.com
• d2f200e9-2973-451c-8db6-4e32d9d830c0.filesusr.com
• 5d97cd6c-e1c7-4261-b34a-656914277e5a.filesusr.com
• d608444a-2011-4dc5-b23c-ec433273bc8a.filesusr.com
• 72777579-9226-4b40-9a3f-98ba75618e9f.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report