MALICIOUS — 952c2e_9bba025a192c4054a2a278edfa6b26a2.pdf
MALICIOUS — 952c2e_9bba025a192c4054a2a278edfa6b26a2.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
fc080aa19bdb0ae6c7a038f2ac88e4c76a987b5fa1d885133c5f9114629b7a2f - SHA-1:
ef21b07ee27222fc6b3932877b1c18f6196fc4dc - MD5:
3364ce8c030c5dc7d4ae66fc71fc518f - ssdeep:
1536:jGFrZQjj8r/eJ5/tkluXoN3njpkkPrsBsWRD:yFrA876G3nO8rb0 - TLSH:
T13A34CEF39493EC847B47AF4379E60219A149C28835339AB459C87B6CD47C5FDAD24930 - Submitted as: 952c2e_9bba025a192c4054a2a278edfa6b26a2.pdf
- File type: pdf · Size: 57541 bytes
- Verdict: malicious (88/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 88/100 is the fusion of 6 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ttraff.com/wix?keyword=showbox+apk+latest, https://d9f81b3a-6c63-4154-a68f-4ceadcf367df.filesusr.com/ugd/154db6_bdf605b3e8224a36829edf10e9a255cd.pdf?index=true, https://674f6bb8-0a19-43e0-adfb-c3e3eb464d23.filesusr.com/ugd/0582e0_68ea6330d8194f4fbdc6801119eac31a.pdf?index=true - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.com/wix?keyword=showbox+apk+latest
- https://d9f81b3a-6c63-4154-a68f-4ceadcf367df.filesusr.com/ugd/154db6_bdf605b3e8224a36829edf10e9a255cd.pdf?index=true
- https://674f6bb8-0a19-43e0-adfb-c3e3eb464d23.filesusr.com/ugd/0582e0_68ea6330d8194f4fbdc6801119eac31a.pdf?index=true
- https://1525f884-a1b9-45ed-bdc8-89c43a19d187.filesusr.com/ugd/78daac_4556f7126ccc4aa390c09412884219e9.pdf?index=true
- https://28330f1c-e1e8-4aca-b8a8-8e85a8b0fc25.filesusr.com/ugd/440e29_a096e567fa1c46499050a85aaea74169.pdf?index=true
- https://ab9478c9-375b-4fad-94f4-d1e92d5b3b3c.filesusr.com/ugd/b148e5_48964654488449c19bedd6f77a51a03b.pdf?index=true
- http://xobade.gabyggonzalez.com/uploads/1/3/1/3/131380969/5748880.pdf
- http://bajasuj.katieriffe.com/uploads/1/3/1/1/131164250/73682c91.pdf
- https://cdn.shopify.com/s/files/1/0431/9074/7295/files/juvosubula.pdf
- https://cdn.shopify.com/s/files/1/0433/1791/9909/files/mozulerago.pdf
- https://cdn.shopify.com/s/files/1/0431/9730/0899/files/c._s._r_full_form.pdf
- https://cdn.shopify.com/s/files/1/0429/1674/1286/files/74701911390.pdf
- https://cdn.shopify.com/s/files/1/0431/4506/8699/files/philips_tv_manual_55pfl5402.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ttraff.com
- d9f81b3a-6c63-4154-a68f-4ceadcf367df.filesusr.com
- 674f6bb8-0a19-43e0-adfb-c3e3eb464d23.filesusr.com
- 1525f884-a1b9-45ed-bdc8-89c43a19d187.filesusr.com
- 28330f1c-e1e8-4aca-b8a8-8e85a8b0fc25.filesusr.com
- ab9478c9-375b-4fad-94f4-d1e92d5b3b3c.filesusr.com
- xobade.gabyggonzalez.com
- bajasuj.katieriffe.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report