MALICIOUS — 362633_e80f3f736fd44169bdfc6ff6ad961c86.pdf

MALICIOUS — 362633_e80f3f736fd44169bdfc6ff6ad961c86.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: e93a4b6c12a030c1fa226cc1ea8e68485b0f206e34156b17be18c90ec18291e6
• SHA-1: ce24c71794d3d11edb27cb26954f881b1eab2f03
• MD5: 5fc7bfb4f718691928e20791666f7fd7
• ssdeep: 768:4PgGzpDy97IFux9HWSfHE6ijMvxvBcbx4dn6SO5d/sdn/IlZFwReqSeUeAXyS:44GFUdjE6I8xvabqn6Dd/sSaEyS
• TLSH: T12E31BEF7109BEC4C3E469B436EA7045A6046D3497233972058CCBB6CD4BC2FD6E94960
• Submitted as: 362633_e80f3f736fd44169bdfc6ff6ad961c86.pdf
• File type: pdf · Size: 41415 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=the+new+school+of+lancaster+calendar, https://cdn.shopify.com/s/files/1/0430/6396/7906/files/32956067052.pdf, https://cdn.shopify.com/s/files/1/0437/0402/5242/files/card_maker_yugioh_apk_pro.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=the+new+school+of+lancaster+calendar
• https://cdn.shopify.com/s/files/1/0430/6396/7906/files/32956067052.pdf
• https://cdn.shopify.com/s/files/1/0437/0402/5242/files/card_maker_yugioh_apk_pro.pdf
• https://cdn.shopify.com/s/files/1/0435/5771/6119/files/gomizifadibakagirudire.pdf
• https://cdn.shopify.com/s/files/1/0441/4291/9832/files/gudawopitu.pdf
• http://files.kappahouseonprospect.com/uploads/1/3/0/7/130775859/bifisaku.pdf
• http://files.shirleywatsonfinancial.com/uploads/1/3/0/7/130776033/vifapawofagadokikofu.pdf
• http://files.sbworldtravel.com/uploads/1/3/1/1/131164440/ridaxifixex-butozaja-wumib.pdf
• http://files.myrnaburksfineart.com/uploads/1/3/1/4/131408100/senubujugajobukile.pdf
• http://files.k10research.com/uploads/1/3/1/6/131606092/2917703.pdf
• https://445e3b32-74e3-4f57-82a4-ac988050d83f.filesusr.com/ugd/fb5067_8eaaff10246a4bb5bff4029d2e4ebfae.pdf?index=true
• https://001cbe35-29fe-4245-8fcf-f9a430cdcf04.filesusr.com/ugd/34e21e_1d74693b81074cfb9f0ee922bb448da2.pdf?index=true
• https://6d2d551c-af39-42d3-b4ee-693879b5e271.filesusr.com/ugd/ea2f88_108866881331419bb38c335dd6d90310.pdf?index=true
• https://4646cdc3-ee07-4336-87bc-398263c40e4a.filesusr.com/ugd/8e6e76_5b3de03a77234208933858175c6a0082.pdf?index=true
• https://7f5a7bf3-b15b-442c-a14e-0cb3f762b7a9.filesusr.com/ugd/f2c1dc_004f7327e897450f979ad7b5548848df.pdf?index=true
• https://9ae20bbe-969f-4e74-ab51-a40df3542759.filesusr.com/ugd/73cb9e_6f5af3ccc8714783a5e27119a540d0ae.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• cdn.shopify.com
• files.kappahouseonprospect.com
• files.shirleywatsonfinancial.com
• files.sbworldtravel.com
• files.myrnaburksfineart.com
• files.k10research.com
• 445e3b32-74e3-4f57-82a4-ac988050d83f.filesusr.com
• 001cbe35-29fe-4245-8fcf-f9a430cdcf04.filesusr.com
• 6d2d551c-af39-42d3-b4ee-693879b5e271.filesusr.com
• 4646cdc3-ee07-4336-87bc-398263c40e4a.filesusr.com
• 7f5a7bf3-b15b-442c-a14e-0cb3f762b7a9.filesusr.com
• 9ae20bbe-969f-4e74-ab51-a40df3542759.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report