MALICIOUS — db93e9_4aa3c6c5ed874cb6b1cc78d88e03b61b.pdf
MALICIOUS — db93e9_4aa3c6c5ed874cb6b1cc78d88e03b61b.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
0da7550292736e3196954238b138988c8574e4db053ed256e5a2660e3ca96392 - SHA-1:
1f0fb683bf53987aa17cdc40ca11bf273787b0e6 - MD5:
7dd97f1089b7bb4e9e6bc38541a186c8 - ssdeep:
768:GgGzpDzmqy0oBPHKIndM2ICNNJZSWTjqHJl8irqVTs+xQOP6:TGFPGLSMjcJlpqVTs+xQOP6 - TLSH:
T196319DF35057EC8C3A8AAF03A9AB045D6046D78E6033D66119D8776CD47CAFD6F00A22 - Submitted as: db93e9_4aa3c6c5ed874cb6b1cc78d88e03b61b.pdf
- File type: pdf · Size: 39807 bytes
- Verdict: malicious (78/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The malicious score of 78/100 is the fusion of 5 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ttraff.me/wix?keyword=holy+infant+school+supply+list, https://48bf9c2a-6378-4b88-b1b3-fee4dd4c7e3f.filesusr.com/ugd/011e4b_d77a25bfefed452885603d83057f1585.pdf?index=true, https://35962feb-da39-4eaa-a50c-146eeb5d920e.filesusr.com/ugd/db93e9_7ef1caf8c926447e9b10032442b268d5.pdf?index=true - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.me/wix?keyword=holy+infant+school+supply+list
- https://48bf9c2a-6378-4b88-b1b3-fee4dd4c7e3f.filesusr.com/ugd/011e4b_d77a25bfefed452885603d83057f1585.pdf?index=true
- https://35962feb-da39-4eaa-a50c-146eeb5d920e.filesusr.com/ugd/db93e9_7ef1caf8c926447e9b10032442b268d5.pdf?index=true
- https://c2200143-3b1e-4a76-a9eb-cabedd830ff4.filesusr.com/ugd/4fb05f_ab9c4017c6954bd89588a4834d660605.pdf?index=true
- https://cdn.shopify.com/s/files/1/0437/7188/7767/files/28601430464.pdf
- https://cdn.shopify.com/s/files/1/0434/4997/4946/files/class_1_amalgam_restoration.pdf
- https://cdn.shopify.com/s/files/1/0463/1029/3669/files/modified_audit_report_emphasis_of_matter.pdf
- https://cdn.shopify.com/s/files/1/0449/7945/4111/files/capacitive_soil_moisture_sensor.pdf
- https://cdn.shopify.com/s/files/1/0429/6241/9863/files/10121107590.pdf
- https://cdn.shopify.com/s/files/1/0437/0500/8293/files/jukinapupupirireb.pdf
- https://cdn.shopify.com/s/files/1/0435/4244/6229/files/wufife.pdf
- https://cdn.shopify.com/s/files/1/0451/3175/9769/files/ryobi_chainsaw_manual_petrol.pdf
- https://cdn.shopify.com/s/files/1/0437/5180/0981/files/39081760924.pdf
- https://cdn.shopify.com/s/files/1/0433/3145/3081/files/counting_nickels_worksheet.pdf
- https://c5d3dc97-1191-4229-8363-eb4cdc1fee5c.filesusr.com/ugd/dc6899_59875b29af914628be6df21b45b61b45.pdf?index=true
- https://7fb9b9d1-ecda-4384-b729-e9c28aae34c8.filesusr.com/ugd/a2de88_ed70f3c2751e424fa8d226e1ad5ce647.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ttraff.me
- 48bf9c2a-6378-4b88-b1b3-fee4dd4c7e3f.filesusr.com
- 35962feb-da39-4eaa-a50c-146eeb5d920e.filesusr.com
- c2200143-3b1e-4a76-a9eb-cabedd830ff4.filesusr.com
- cdn.shopify.com
- c5d3dc97-1191-4229-8363-eb4cdc1fee5c.filesusr.com
- 7fb9b9d1-ecda-4384-b729-e9c28aae34c8.filesusr.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report