MALICIOUS — 54dfea_15ce62c21fc742a081de5b306c3853f0.pdf

MALICIOUS — 54dfea_15ce62c21fc742a081de5b306c3853f0.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: ef518b946eb7131913091ec51df1441373f743dd956a6526a521a3aa2501045c
• SHA-1: 22f402c8cf2e6ef1c7c593346e48eb9a111bdd8c
• MD5: e2bfeb1f5095768afe2f6cb0dc54c2d7
• ssdeep: 768:CgGzpDsIXU/SWIz979M9Ir5fS+obaOYemISU0kRGGVd9pJR8GS:fGFQ2/79MI1Vo5YemIS+AGVdBR8GS
• TLSH: T1A533BFF341A7EC8CA9C79B032DFA1999E246D3CC6033A66494D8772DC4787BD6E10611
• Submitted as: 54dfea_15ce62c21fc742a081de5b306c3853f0.pdf
• File type: pdf · Size: 49192 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=vw+t4+workshop+manual+pdf, http://files.northlightsfauxmagerie.org/uploads/1/3/0/7/130775897/sivuketi.pdf, http://files.jennifernocktrainingandconsultancy.com/uploads/1/3/0/8/130814169/risuf-daputerutenig-nodinaj.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=vw+t4+workshop+manual+pdf
• http://files.northlightsfauxmagerie.org/uploads/1/3/0/7/130775897/sivuketi.pdf
• http://files.jennifernocktrainingandconsultancy.com/uploads/1/3/0/8/130814169/risuf-daputerutenig-nodinaj.pdf
• http://nuxufa.planetdk.net/uploads/1/3/1/4/131407406/4829724.pdf
• http://files.missionadventuretours.com/uploads/1/3/2/6/132681352/6fff20fec.pdf
• https://e4af9465-426a-43cd-bb7c-609a3713ba08.filesusr.com/ugd/dfb5f8_7293dba5df2c4498b2652fe040684caa.pdf?index=true
• https://6a45bb82-f95c-4d80-949f-3effc0e63a68.filesusr.com/ugd/8c0e65_86cf051b181d4475b455f948141e98a3.pdf?index=true
• https://cfb8028a-9530-4eed-ac09-dc462b4ae659.filesusr.com/ugd/87fdc7_cb25b29a73e340ac907012d7f7480578.pdf?index=true
• https://cdn.shopify.com/s/files/1/0461/1457/0404/files/alembic_pharma_annual_report_2019.pdf
• https://cdn.shopify.com/s/files/1/0437/3767/7989/files/87488658560.pdf
• https://c52c2c47-39fa-4577-b5c3-2c82bdb589f2.filesusr.com/ugd/21e9e0_5a57eec6a01944b4b43da9ffb59007ba.pdf?index=true
• https://c18d14f3-cfd0-4aa8-8989-c97217a15e7a.filesusr.com/ugd/f3ecbe_ea46a6880d9b4d47ad385f3e989a23c9.pdf?index=true
• https://128e02d1-07f2-49e7-ad28-a76ecf815aeb.filesusr.com/ugd/bf57b5_b1f14d6b25f7480e83961adb3fcf05b9.pdf?index=true
• https://1a744b53-c135-4360-93c9-87cf7604e1a2.filesusr.com/ugd/ede58b_6cacb7653e5344c89cb6f4b8b5cc2544.pdf?index=true
• https://d85ad021-9d3e-4637-9d20-3f5084600db2.filesusr.com/ugd/430cb2_224aefa1bb784e8c99edb9a1524e011e.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• files.northlightsfauxmagerie.org
• files.jennifernocktrainingandconsultancy.com
• nuxufa.planetdk.net
• files.missionadventuretours.com
• e4af9465-426a-43cd-bb7c-609a3713ba08.filesusr.com
• 6a45bb82-f95c-4d80-949f-3effc0e63a68.filesusr.com
• cfb8028a-9530-4eed-ac09-dc462b4ae659.filesusr.com
• cdn.shopify.com
• c52c2c47-39fa-4577-b5c3-2c82bdb589f2.filesusr.com
• c18d14f3-cfd0-4aa8-8989-c97217a15e7a.filesusr.com
• 128e02d1-07f2-49e7-ad28-a76ecf815aeb.filesusr.com
• 1a744b53-c135-4360-93c9-87cf7604e1a2.filesusr.com
• d85ad021-9d3e-4637-9d20-3f5084600db2.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report