MALICIOUS — 2e4eb4_e7707bb15a1e4d58927af406e77e779a.pdf

MALICIOUS — 2e4eb4_e7707bb15a1e4d58927af406e77e779a.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: faed6bf1fee061f9f12b43a32d895e7559e3d43c97caf1298303e7f1b5b73be6
• SHA-1: 3eba808193193e1576d2ac881796f0838f46c999
• MD5: a951ad6fcb66af849f6308ecafbb8158
• ssdeep: 768:BgGzpD9TVrP4LPHxW3bYJN0o5QFypgud+LpUCj1dP7hg22n:yGFhMWrYUowmgW+eCv222n
• TLSH: T10E317CF344A7ED4C7A9B5B13DDAA00692086D78922369760549CBB2CD4BC2FCBE50D31
• Submitted as: 2e4eb4_e7707bb15a1e4d58927af406e77e779a.pdf
• File type: pdf · Size: 41119 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=ps3+downgrade+service+deutschland, http://tixezu.kellymansfieldart.com/uploads/1/3/1/4/131407406/348448.pdf, http://files.worthingtonorchestra.com/uploads/1/3/1/3/131379085/4055547.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=ps3+downgrade+service+deutschland
• http://tixezu.kellymansfieldart.com/uploads/1/3/1/4/131407406/348448.pdf
• http://files.worthingtonorchestra.com/uploads/1/3/1/3/131379085/4055547.pdf
• http://files.gregpicardandwendypicardgorham.com/uploads/1/3/0/9/130969532/sazuxoseroj-nupadupotu.pdf
• http://kalavoz.phstravelclub.org/uploads/1/3/0/8/130874493/8306885.pdf
• https://cdn.shopify.com/s/files/1/0431/0489/5143/files/debt_counselling_process.pdf
• https://cdn.shopify.com/s/files/1/0435/5011/3943/files/bevel_protractor.pdf
• https://cdn.shopify.com/s/files/1/0427/6404/2396/files/viwawomenulozopimuwa.pdf
• https://cdn.shopify.com/s/files/1/0433/1703/5166/files/lic_jeevan_anand_policy_details_in_telugu.pdf
• https://aec3de26-2d03-44c6-ba33-a0f663699a4a.filesusr.com/ugd/1cc777_9fff06e1228b4752a94f336a0d9a62f0.pdf?index=true
• https://d2900a77-09fe-4680-9f6a-376555189997.filesusr.com/ugd/277b62_b568d33eae2f4075833d4a6a7d18d5b1.pdf?index=true
• https://5fc11539-6c77-4cfb-ab66-e73e5603937a.filesusr.com/ugd/de60da_06f005649a30409db6840556d390328c.pdf?index=true
• https://62882103-2358-4211-825b-43f8a21b8da1.filesusr.com/ugd/bcc0e4_7b47d17fe72340688f2ebe552280ddb9.pdf?index=true
• https://602d76cf-39b8-4805-a783-f5e529798ba1.filesusr.com/ugd/227d0f_41dc10072f704395a14aa51aa71f922f.pdf?index=true
• https://7cd6f4b4-11fa-4375-9dfe-5f978187b898.filesusr.com/ugd/2f7489_6f9c8da1323b43c895addc60ccad6ee0.pdf?index=true
• https://825a1024-bb7a-4adf-92c6-b914ac21ddab.filesusr.com/ugd/f1780b_6fdeed7b85a149749cb18f9e1e52f613.pdf?index=true
• https://b04f05e9-78a8-4209-b3de-29f08fa0ce33.filesusr.com/ugd/7f614e_c050e02b6de44a4cacfa4edc05cb7b2c.pdf?index=true
• https://29c93198-f742-4700-bd49-fe833de9997a.filesusr.com/ugd/7cefa9_b4faf4a4986c45128480257de5c9cf09.pdf?index=true
• https://f479ea89-c8fe-4df4-8160-421160b062d6.filesusr.com/ugd/7d1dc9_c9db4f037e854cc881340ae36641ffa8.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• tixezu.kellymansfieldart.com
• files.worthingtonorchestra.com
• files.gregpicardandwendypicardgorham.com
• kalavoz.phstravelclub.org
• cdn.shopify.com
• aec3de26-2d03-44c6-ba33-a0f663699a4a.filesusr.com
• d2900a77-09fe-4680-9f6a-376555189997.filesusr.com
• 5fc11539-6c77-4cfb-ab66-e73e5603937a.filesusr.com
• 62882103-2358-4211-825b-43f8a21b8da1.filesusr.com
• 602d76cf-39b8-4805-a783-f5e529798ba1.filesusr.com
• 7cd6f4b4-11fa-4375-9dfe-5f978187b898.filesusr.com
• 825a1024-bb7a-4adf-92c6-b914ac21ddab.filesusr.com
• b04f05e9-78a8-4209-b3de-29f08fa0ce33.filesusr.com
• 29c93198-f742-4700-bd49-fe833de9997a.filesusr.com
• f479ea89-c8fe-4df4-8160-421160b062d6.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report