MALICIOUS — 3e5db3_7faafe329d2d49f691a4760ec2ef351f.pdf

MALICIOUS — 3e5db3_7faafe329d2d49f691a4760ec2ef351f.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 2278e54855a05fdf11a6e7f25ec4925a7a2e666235b7e026f1adaca2c5bf1656
• SHA-1: deb0f5d6d05d35d430afe2cce8bdea8d89307941
• MD5: 33285eef28e68b1d12bf28d71fecbc1b
• ssdeep: 1536:RGFuIYjTh1tXsEwZh6qCQmmn5ntl8CgtE5GCrvE6i+nFuiMRrJ6N:0Fu7jTh1mEwZ8pmJtl8q5Gg1BZ
• TLSH: T13737D0F32097ED8C7A8B6F436EE3000A5541AB8E603792501598776CC97CAFDBE40B65
• Submitted as: 3e5db3_7faafe329d2d49f691a4760ec2ef351f.pdf
• File type: pdf · Size: 72392 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=no+orc+left+behind+trophy+guide, https://a0ec6386-5684-4833-932e-94807b20c9fb.filesusr.com/ugd/d7d6cd_8be4691c2a1443c7b00ba1883089a265.pdf?index=true, https://efcc13d5-fa24-4ef5-87e6-8174401c9ec9.filesusr.com/ugd/b1b3ad_932c6200b7c242249136abb5a0685e9d.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=no+orc+left+behind+trophy+guide
• https://a0ec6386-5684-4833-932e-94807b20c9fb.filesusr.com/ugd/d7d6cd_8be4691c2a1443c7b00ba1883089a265.pdf?index=true
• https://efcc13d5-fa24-4ef5-87e6-8174401c9ec9.filesusr.com/ugd/b1b3ad_932c6200b7c242249136abb5a0685e9d.pdf?index=true
• https://7eec2876-22ef-4d7a-9bbe-9c9cabbcfde6.filesusr.com/ugd/bb05c1_3393cd3b6d0b4546ba17a0493dd99860.pdf?index=true
• https://3fe23bc0-fa26-4d53-9fd5-a79a2509a5fd.filesusr.com/ugd/24deb6_eb26b35d2818408a9aab419f7ca1a19f.pdf?index=true
• https://cdn.shopify.com/s/files/1/0431/2681/6932/files/kannada_janapada_hadu_song.pdf
• https://cdn.shopify.com/s/files/1/0430/1121/1417/files/wowivuluwotixitiw.pdf
• https://cdn.shopify.com/s/files/1/0432/2004/1886/files/69432315854.pdf
• https://cdn.shopify.com/s/files/1/0434/6734/1974/files/87870938396.pdf
• https://cdn.shopify.com/s/files/1/0434/1871/4264/files/87785965118.pdf
• https://cdn.shopify.com/s/files/1/0435/3071/5288/files/fusisi.pdf
• https://cdn.shopify.com/s/files/1/0429/6559/8364/files/dawuk.pdf
• https://cdn.shopify.com/s/files/1/0435/9133/6099/files/regression_and_correlation_analysis_in_statistics.pdf
• https://cdn.shopify.com/s/files/1/0431/4205/4048/files/68393002253.pdf
• https://cdn.shopify.com/s/files/1/0432/1509/3924/files/ditakimamizejutiserodavo.pdf
• https://cdn.shopify.com/s/files/1/0436/0686/8131/files/54375090809.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• a0ec6386-5684-4833-932e-94807b20c9fb.filesusr.com
• efcc13d5-fa24-4ef5-87e6-8174401c9ec9.filesusr.com
• 7eec2876-22ef-4d7a-9bbe-9c9cabbcfde6.filesusr.com
• 3fe23bc0-fa26-4d53-9fd5-a79a2509a5fd.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report