MALICIOUS — edb4a7_9dc47ed1359044e597f54a3a9bb90663.pdf

MALICIOUS — edb4a7_9dc47ed1359044e597f54a3a9bb90663.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: e98ac6a36404f0ab1ad5f5ff23cb2ce51b40be621f970a6c11581daba2340405
• SHA-1: 77bbb7ecd1c66a0dd0f3c799b1c2ba254011dc89
• MD5: 8a3f1c72c33ac38aa5a4dfab0e9d3700
• ssdeep: 768:MgGzpDW+1OztYn9xX1ZyDummsQHJP+8jwQt0FH2H5xa5ZsTg/X7:JGFyNqWmsQJ+8jzt+E5xa5eTg/X7
• TLSH: T14B308DF3105BEC8C3ECBAB17ADE7155AA049C3487135E6A044D8376CC87C6ADAF506A1
• Submitted as: edb4a7_9dc47ed1359044e597f54a3a9bb90663.pdf
• File type: pdf · Size: 36317 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=hayden+mcneil+biology+lab+manual+answers, http://files.southwickrangers.org/uploads/1/3/0/7/130740175/vemubawixoz_rukifawadona.pdf, http://files.mesheracapital.com/uploads/1/3/1/4/131407802/93c794.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=hayden+mcneil+biology+lab+manual+answers
• http://files.southwickrangers.org/uploads/1/3/0/7/130740175/vemubawixoz_rukifawadona.pdf
• http://files.mesheracapital.com/uploads/1/3/1/4/131407802/93c794.pdf
• http://sozituki.diogenpro.com/uploads/1/3/0/7/130776043/loraxujij.pdf
• http://files.mtbsiteservicesbusiness.com/uploads/1/3/0/8/130813510/b01f3b.pdf
• https://fc917533-7dc0-49f2-b0e5-04c649359f92.filesusr.com/ugd/4b874d_5cccf342e73743b6bb5c7e20c6341da2.pdf?index=true
• https://094d357d-5e35-4687-8a27-c4a794d4f0ea.filesusr.com/ugd/94e5ef_43461c98ccae4f87a6869d8191d4ffb1.pdf?index=true
• https://3e120040-4a2e-4f66-9cab-282eb7cf03b0.filesusr.com/ugd/3be48b_b00015e1be3f407d96c2beaad4122de9.pdf?index=true
• https://339857e6-8870-488f-b166-42e3dd75c86d.filesusr.com/ugd/234f58_fd417132d2124546bc34bef98c884be4.pdf?index=true
• https://19aa10bc-303f-4414-9144-12b8a078d100.filesusr.com/ugd/26481d_cbb63cceafb94361b1ecac6c8076d04e.pdf?index=true
• https://cdn.shopify.com/s/files/1/0437/0428/7383/files/xefomavarabikuva.pdf
• https://cdn.shopify.com/s/files/1/0430/7877/9029/files/essentials_of_oceanography_12th_edit.pdf
• https://cdn.shopify.com/s/files/1/0452/4402/2944/files/energy_ecology_and_environment.pdf
• https://cdn.shopify.com/s/files/1/0433/0687/7080/files/39806276645.pdf
• https://cdn.shopify.com/s/files/1/0459/6999/7984/files/sevtech_twilight_forest_guide.pdf
• https://cdn.shopify.com/s/files/1/0451/3175/9769/files/open_office_spreadsheet_software_free.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• files.southwickrangers.org
• files.mesheracapital.com
• sozituki.diogenpro.com
• files.mtbsiteservicesbusiness.com
• fc917533-7dc0-49f2-b0e5-04c649359f92.filesusr.com
• 094d357d-5e35-4687-8a27-c4a794d4f0ea.filesusr.com
• 3e120040-4a2e-4f66-9cab-282eb7cf03b0.filesusr.com
• 339857e6-8870-488f-b166-42e3dd75c86d.filesusr.com
• 19aa10bc-303f-4414-9144-12b8a078d100.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report