MALICIOUS — 1cc7e8_e94402c24340442ca52b1bae986b94f2.pdf

MALICIOUS — 1cc7e8_e94402c24340442ca52b1bae986b94f2.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: f3b6b138f8263c425e2aec7b63a6034038aac1c788b2f37e9bf37783d237444c
• SHA-1: c3f321be85ee223f3626e8f7c6a002f68817b678
• MD5: aff61c60b93eb12bbc6459e6624db1c9
• ssdeep: 768:5gGzpD9XPrzlSHYCYF1NDro8XX1WYoDL3nunnTMrZxgLbOYuryZKfVMHPvKl:6GFRno4CYFn3PnT0gLbluxfCHPvKl
• TLSH: T100339FF310A7DD8C7AC79B03AEE2011E6589D6886173A664088C777CC97CAFD6E10A51
• Submitted as: 1cc7e8_e94402c24340442ca52b1bae986b94f2.pdf
• File type: pdf · Size: 49142 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=riddle+school+unblocked+2, http://dozuku.irishwolfhounddog.com/uploads/1/3/0/9/130969754/6836394.pdf, http://nadefefi.karensnovels.com/uploads/1/3/1/6/131606592/fomogaligenopeb.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=riddle+school+unblocked+2
• http://dozuku.irishwolfhounddog.com/uploads/1/3/0/9/130969754/6836394.pdf
• http://nadefefi.karensnovels.com/uploads/1/3/1/6/131606592/fomogaligenopeb.pdf
• http://files.snowyriverfarms.com/uploads/1/3/0/8/130874125/jojugowominisedetif.pdf
• http://files.nanonore.com/uploads/1/3/0/8/130874295/rugujusugiko.pdf
• http://lijureb.ps889k.org/uploads/1/3/0/8/130874612/xutino.pdf
• https://cdn.shopify.com/s/files/1/0431/9870/9917/files/d_d_5th_ed_character_sheet_editable.pdf
• https://cdn.shopify.com/s/files/1/0433/9345/0134/files/62247157223.pdf
• https://cdn.shopify.com/s/files/1/0475/3565/3030/files/74165137098.pdf
• https://cdn.shopify.com/s/files/1/0440/6103/2598/files/elementary_algebra_formulas.pdf
• https://cdn.shopify.com/s/files/1/0431/0636/9697/files/dezefezufukowomokifajan.pdf
• https://cdn.shopify.com/s/files/1/0447/5689/3847/files/synergism_meaning.pdf
• https://cdn.shopify.com/s/files/1/0447/3788/8410/files/ciencias_formales_definicion.pdf
• https://cdn.shopify.com/s/files/1/0434/3994/7932/files/42405383644.pdf
• https://e3590002-e65c-41f8-a0d4-aa84bd971893.filesusr.com/ugd/a9248e_ddc0fabbb0ff4c0f9dc9a9c316db5b12.pdf?index=true
• https://d43a5e2f-ace4-48da-baae-573c63b54255.filesusr.com/ugd/451a43_cb836bb14c06407ebf3db36931d782a4.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• dozuku.irishwolfhounddog.com
• nadefefi.karensnovels.com
• files.snowyriverfarms.com
• files.nanonore.com
• lijureb.ps889k.org
• cdn.shopify.com
• e3590002-e65c-41f8-a0d4-aa84bd971893.filesusr.com
• d43a5e2f-ace4-48da-baae-573c63b54255.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report