MALICIOUS — 417718_7b840603161f4572b52311d168e73a02.pdf

MALICIOUS — 417718_7b840603161f4572b52311d168e73a02.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 18517bb87c879fbce13d8b53f8a468b3c3ab741d2bf53c24d68b2f03d08a4b11
• SHA-1: 097db8078f6929d0f6f88b0c071de106b3399a66
• MD5: 0ddf09cbe7d7dce2ea9e0196c0c7e088
• ssdeep: 1536:mGFH98vcff5fMIA8hQqhhPJfGtr43T3asJ283DGJ+UTXigVkffy9:/FH94H8hlhhJqED3Ng83DGJ+UTXhVYM
• TLSH: T1B139D0F39147DDCC3983DB6359A61654B146AE8921339A6050C47B7CC47C3FDAE80BA1
• Submitted as: 417718_7b840603161f4572b52311d168e73a02.pdf
• File type: pdf · Size: 84652 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=namekian+dragon+balls+vs+earth, https://db6b2b01-b162-498f-af28-6e493eded2b0.filesusr.com/ugd/9d7ad9_e79553496e8d4e53b27455ac568e216d.pdf?index=true, https://89cdce26-061f-411e-a095-34bf839943d8.filesusr.com/ugd/277b62_6367dfddc09e44e6b1605577661205e6.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=namekian+dragon+balls+vs+earth
• https://db6b2b01-b162-498f-af28-6e493eded2b0.filesusr.com/ugd/9d7ad9_e79553496e8d4e53b27455ac568e216d.pdf?index=true
• https://89cdce26-061f-411e-a095-34bf839943d8.filesusr.com/ugd/277b62_6367dfddc09e44e6b1605577661205e6.pdf?index=true
• https://c288df73-8656-4f24-a0a7-1c9c69ac61be.filesusr.com/ugd/2994dd_477fd5f9c2e343eeb1cffc35ac4378f9.pdf?index=true
• http://files.flickyeahpodcast.com/uploads/1/3/0/7/130775393/cd5162.pdf
• https://315b1b77-d0dc-4968-9afb-2c8d4bfc7e3b.filesusr.com/ugd/4b874d_df98042170954bda8cba6999418f0fbc.pdf?index=true
• https://f2aef2a1-eec4-4145-b5a7-919e55d70c4e.filesusr.com/ugd/7d1dc9_b3a8a85fc4a2489b961d4792017caa16.pdf?index=true
• https://9c6f0df0-4918-4220-8be5-d4b8cc3b20b6.filesusr.com/ugd/dcf311_bfbd33e20a804fa09b269749c2a18b2e.pdf?index=true
• https://1c5c794a-123c-42b3-823f-3b23f67f139b.filesusr.com/ugd/d5415a_7d9503463b9641a6b2c6d6c9e56abf49.pdf?index=true
• https://05736864-4e47-4f84-9e97-01809fe3fd19.filesusr.com/ugd/a91264_b44acdf288274d3abb5ef869ee512d52.pdf?index=true
• https://22bc5435-2e64-4386-b35a-6fd57f2c75d8.filesusr.com/ugd/18f527_fd4b11c8e63343dfab92b58dc4028474.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• db6b2b01-b162-498f-af28-6e493eded2b0.filesusr.com
• 89cdce26-061f-411e-a095-34bf839943d8.filesusr.com
• c288df73-8656-4f24-a0a7-1c9c69ac61be.filesusr.com
• files.flickyeahpodcast.com
• 315b1b77-d0dc-4968-9afb-2c8d4bfc7e3b.filesusr.com
• f2aef2a1-eec4-4145-b5a7-919e55d70c4e.filesusr.com
• 9c6f0df0-4918-4220-8be5-d4b8cc3b20b6.filesusr.com
• 1c5c794a-123c-42b3-823f-3b23f67f139b.filesusr.com
• 05736864-4e47-4f84-9e97-01809fe3fd19.filesusr.com
• 22bc5435-2e64-4386-b35a-6fd57f2c75d8.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report