MALICIOUS — 2b98a3_c240ea262b8c47c28e52f36c46fd80aa.pdf

MALICIOUS — 2b98a3_c240ea262b8c47c28e52f36c46fd80aa.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

SHA-256: 007dd1fee09199c9fab993df7e23480c76eec2c062238b327762d4dd01782249
SHA-1: 055775cbb099044c0b1f9bf1a9d9527dbb80a328
MD5: 21fa344c02ee6d596778dfe48eb07f19
ssdeep: 1536:KGFD0K/eMHH1I3LHBspncTt7muCk/JSRU5MH4VURKWaoPEzI:zFDZRwsuIkSRU5MNRJL
TLSH: T1EC36C0F310A7DC8C7A8B6F0369EA1019A04ADB49623396605588777CC57CAFD6E90F11
Submitted as: 2b98a3_c240ea262b8c47c28e52f36c46fd80aa.pdf
File type: pdf · Size: 64997 bytes
Verdict: malicious (78/100)

Detections (2 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ttraff.club/wix?keyword=mba01+manual+bottle+label+applicator, https://ffe0a59b-28c9-49e9-88f5-0842a72c66a5.filesusr.com/ugd/429b25_026b46a2d4f94e199d09b0e690fc9bf2.pdf?index=true, https://22d4760d-0511-4e42-a791-fdff23529de6.filesusr.com/ugd/035627_7ce75505a5b14889a45632d0461b0330.pdf?index=true - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://ttraff.club/wix?keyword=mba01+manual+bottle+label+applicator
https://ffe0a59b-28c9-49e9-88f5-0842a72c66a5.filesusr.com/ugd/429b25_026b46a2d4f94e199d09b0e690fc9bf2.pdf?index=true
https://22d4760d-0511-4e42-a791-fdff23529de6.filesusr.com/ugd/035627_7ce75505a5b14889a45632d0461b0330.pdf?index=true
https://b46b006c-0cfa-485f-8776-6ceac84034a4.filesusr.com/ugd/3eed2b_2193305a82cf4784b0e1afb085d97232.pdf?index=true
https://8db325b2-be96-4e7c-a6f6-079514a94629.filesusr.com/ugd/7c30af_d1320b93f5b94599924a816282a0d35f.pdf?index=true
https://fc053dfe-c0ac-437c-a661-91bb26df62db.filesusr.com/ugd/3ddeef_88a5f32acc9e4e29bcf7c6a6370b2891.pdf?index=true
https://4ec75e80-37a0-4101-ad3a-eb0c7d811d6f.filesusr.com/ugd/891219_79c76f2d42dc4686873ee0ac55c85701.pdf?index=true
https://cdn.shopify.com/s/files/1/0438/2598/7734/files/somipadudatipaginigimuka.pdf
https://cdn.shopify.com/s/files/1/0431/6626/9597/files/jakisil.pdf
https://cdn.shopify.com/s/files/1/0430/2408/9242/files/28589009088.pdf
https://cdn.shopify.com/s/files/1/0427/6604/1244/files/3d_solidworks.pdf
https://cdn.shopify.com/s/files/1/0434/6750/5824/files/lozanomatibosot.pdf
https://cdn.shopify.com/s/files/1/0437/6359/7473/files/21111382108.pdf
https://cdn.shopify.com/s/files/1/0431/8301/4048/files/livros_sobre_avivamento.pdf
https://cdn.shopify.com/s/files/1/0468/8406/1341/files/kozapi.pdf
https://cdn.shopify.com/s/files/1/0435/3844/8548/files/64608119177.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ttraff.club
ffe0a59b-28c9-49e9-88f5-0842a72c66a5.filesusr.com
22d4760d-0511-4e42-a791-fdff23529de6.filesusr.com
b46b006c-0cfa-485f-8776-6ceac84034a4.filesusr.com
8db325b2-be96-4e7c-a6f6-079514a94629.filesusr.com
fc053dfe-c0ac-437c-a661-91bb26df62db.filesusr.com
4ec75e80-37a0-4101-ad3a-eb0c7d811d6f.filesusr.com
cdn.shopify.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report