MALICIOUS — 685707_a5bd883de2774d77993f44dffe7ae83d.pdf

MALICIOUS — 685707_a5bd883de2774d77993f44dffe7ae83d.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 54 detection engines flagged it.

Identification

• SHA-256: 1c193bbf7182ca62350a2d5e6c7a0e24108eac84bba868869f6df16a718e15aa
• SHA-1: 7e2cc4a236e66524f6c12cc932efba7899b3fd67
• MD5: 3213f069efa426552a257cd6a866e038
• ssdeep: 768:PgGzpD8XBDOmJVqE8Ga8MRHZ4v/rTB7uBmF6ZNHlOxNpGZarUlNIMq7MDng:4GFoAbz8MRyHrTB7S9ZNFOjpSarizDng
• TLSH: T1D731AEF34457EC8C3487AB039EFE24156145EB8D5133ABB448DC3B6CC5A86BEAE41960
• Submitted as: 685707_a5bd883de2774d77993f44dffe7ae83d.pdf
• File type: pdf · Size: 41070 bytes
• Verdict: malicious (78/100)

Detections (2 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=science+court+electric+current+worksheet+answers, https://8d94b0a8-b82f-42e1-b594-d2315a26aa50.filesusr.com/ugd/29c71c_49d5a9c3338d4b62ae9720d16424fc66.pdf?index=true, https://cf22f4f4-0b20-44f1-80f7-20d8885a34b8.filesusr.com/ugd/3f80ec_d4dc942ed53c4463bd15b069d3c6ca3d.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=science+court+electric+current+worksheet+answers
• https://8d94b0a8-b82f-42e1-b594-d2315a26aa50.filesusr.com/ugd/29c71c_49d5a9c3338d4b62ae9720d16424fc66.pdf?index=true
• https://cf22f4f4-0b20-44f1-80f7-20d8885a34b8.filesusr.com/ugd/3f80ec_d4dc942ed53c4463bd15b069d3c6ca3d.pdf?index=true
• https://d45abef7-3600-4a5d-a770-f4d4eb1541fe.filesusr.com/ugd/45fd81_8157e404ba1847868a6d0f66d1a66d3f.pdf?index=true
• https://01db5a16-aa90-4eed-a6b3-13a46ad118fa.filesusr.com/ugd/6f5f23_ee626ad908ef4611a4fc6d144a997459.pdf?index=true
• https://cdn.shopify.com/s/files/1/0435/4742/6965/files/crusaders_vs_hurricanes_team_sheet.pdf
• https://cdn.shopify.com/s/files/1/0435/5925/6225/files/rimadesozuvumofagi.pdf
• https://cdn.shopify.com/s/files/1/0438/9522/6523/files/futovud.pdf
• https://cdn.shopify.com/s/files/1/0441/4029/8392/files/accounting_word_meaning.pdf
• https://cdn.shopify.com/s/files/1/0434/0475/5096/files/raxedijoze.pdf
• https://cdn.shopify.com/s/files/1/0437/2440/6935/files/sovodakulebedetogax.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• 8d94b0a8-b82f-42e1-b594-d2315a26aa50.filesusr.com
• cf22f4f4-0b20-44f1-80f7-20d8885a34b8.filesusr.com
• d45abef7-3600-4a5d-a770-f4d4eb1541fe.filesusr.com
• 01db5a16-aa90-4eed-a6b3-13a46ad118fa.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report