MALICIOUS — 3b6424_dbf8c3b533d64ab1b8defef36b5456e0.pdf

MALICIOUS — 3b6424_dbf8c3b533d64ab1b8defef36b5456e0.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 54 detection engines flagged it.

Identification

• SHA-256: 1fe651ec92531ee1117616821838b760194d6f6838ec2ad0811548c20abb66e4
• SHA-1: 5691a0d9063c041909cb253c3ef1dc17b143d226
• MD5: 385c943ec7513552c071f2e06d8bb978
• ssdeep: 1536:fGFvMNOIFi2B7+0oOMOA6Ja8SMjs8JigmsMto:OFvqrgK7hodR6E8SqYgJMm
• TLSH: T14E34AFF3005BDE8C3A87AF076AE530586185DE4C7072AB6045987B7CC57C3ACBE60A61
• Submitted as: 3b6424_dbf8c3b533d64ab1b8defef36b5456e0.pdf
• File type: pdf · Size: 57232 bytes
• Verdict: malicious (78/100)

Detections (2 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=wicca+a+year+and+a+day+timothy+roderick+pdf+free+download, https://cdn.shopify.com/s/files/1/0432/2931/5229/files/gene_therapy_for_inherited_disorders.pdf, https://cdn.shopify.com/s/files/1/0436/7115/8949/files/bid_wars_pawn_empire_apk.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=wicca+a+year+and+a+day+timothy+roderick+pdf+free+download
• https://cdn.shopify.com/s/files/1/0432/2931/5229/files/gene_therapy_for_inherited_disorders.pdf
• https://cdn.shopify.com/s/files/1/0436/7115/8949/files/bid_wars_pawn_empire_apk.pdf
• https://cdn.shopify.com/s/files/1/0438/6570/2565/files/interview_questions_and_answers_for_teacher.pdf
• https://cdn.shopify.com/s/files/1/0464/7528/0552/files/bandicam_new_version_free.pdf
• https://0c6eb7b9-9748-49e7-a757-cd6e0072dfba.filesusr.com/ugd/d6af85_fe606c4b7e7d4512adef94853cbf012c.pdf?index=true
• https://2c3b353e-a263-4905-b130-6dd2d45f61e6.filesusr.com/ugd/868401_aeb2bc10944446c393b76daa0424263b.pdf?index=true
• https://95c9412c-b597-4ca3-b281-4636f7758f1a.filesusr.com/ugd/34e21e_a3d074332e914b189f9410e085eb1476.pdf?index=true
• https://0619cd6b-d8cc-4697-8efe-136581b3d48a.filesusr.com/ugd/0286dd_f9d1d857437e4c01b3ba5535e31479fe.pdf?index=true
• https://43c83fb5-2a5e-4a77-924f-607b3cc01b67.filesusr.com/ugd/7d1dc9_2a7989266c9e41c8a861c107c2ca209f.pdf?index=true
• https://a83290fc-2509-44b4-baba-d9635126b6d1.filesusr.com/ugd/9bd82e_7df1ce65c8d840a58bbc801061402b80.pdf?index=true
• https://153dca79-a3d5-4baa-8921-d627a51a4997.filesusr.com/ugd/8ce377_52760326c4d9474299a852f48bca0381.pdf?index=true
• https://6f82af1d-7e24-441d-8622-0bc0ca1737f7.filesusr.com/ugd/de3d83_27ffd16d7e7d46d8acd50520a7fc677c.pdf?index=true
• https://3efe6515-cf04-40db-944e-b0c4747fe731.filesusr.com/ugd/5e8de6_c89cc652d76148fd937a387af7c870a0.pdf?index=true
• https://37da5d68-0f16-41a3-8565-8b0701101630.filesusr.com/ugd/8acad3_0e529c1c10e943ec8b07085befa5e903.pdf?index=true
• https://500617ff-15b4-42b6-9931-e3b1ef2769a8.filesusr.com/ugd/3bcfef_88c05c537214416c8b94248d9c7ec1b7.pdf?index=true
• https://1a625630-568e-4cd1-bad9-17ef499c9c04.filesusr.com/ugd/e948c1_18505295c53647269fbbb0c9d21be8bd.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• cdn.shopify.com
• 0c6eb7b9-9748-49e7-a757-cd6e0072dfba.filesusr.com
• 2c3b353e-a263-4905-b130-6dd2d45f61e6.filesusr.com
• 95c9412c-b597-4ca3-b281-4636f7758f1a.filesusr.com
• 0619cd6b-d8cc-4697-8efe-136581b3d48a.filesusr.com
• 43c83fb5-2a5e-4a77-924f-607b3cc01b67.filesusr.com
• a83290fc-2509-44b4-baba-d9635126b6d1.filesusr.com
• 153dca79-a3d5-4baa-8921-d627a51a4997.filesusr.com
• 6f82af1d-7e24-441d-8622-0bc0ca1737f7.filesusr.com
• 3efe6515-cf04-40db-944e-b0c4747fe731.filesusr.com
• 37da5d68-0f16-41a3-8565-8b0701101630.filesusr.com
• 500617ff-15b4-42b6-9931-e3b1ef2769a8.filesusr.com
• 1a625630-568e-4cd1-bad9-17ef499c9c04.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report