MALICIOUS — bc0b97_3ff9e502500d47ed8350430fe4cc72f4.pdf

MALICIOUS — bc0b97_3ff9e502500d47ed8350430fe4cc72f4.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 2315093c06c254e3e0db73a1716cc0e6c1efe97b398032bfc330712913eed19b
• SHA-1: 4268ecd49f5f7ef9625fb3e143216139c69df578
• MD5: eb2ac3757f173739f00e9e5aad3f975c
• ssdeep: 768:NgGzpDaXZEMIwke4ZpvchCO3cTdGTVNlw6fIvXAl8pWeAprxOd:uGFGpZDTflwfvXACJAprxOd
• TLSH: T16B328EF3415BFC8C7ACEAB17ADEB1118904AE78951329A604988375CC47C6EF7F50921
• Submitted as: bc0b97_3ff9e502500d47ed8350430fe4cc72f4.pdf
• File type: pdf · Size: 45967 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=circles+and+ellipses+worksheet+u15+ws1+answers, https://a7a1feca-7dc1-4532-b9d3-4af6d0305216.filesusr.com/ugd/12745a_2ba540d727e64cc7959d35114b6b1f9c.pdf?index=true, https://73519f52-b9e0-4218-a76c-7947f55c1fb5.filesusr.com/ugd/c4dbd3_8c78009b6a2d4c0c9468e1db4eac7913.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=circles+and+ellipses+worksheet+u15+ws1+answers
• https://a7a1feca-7dc1-4532-b9d3-4af6d0305216.filesusr.com/ugd/12745a_2ba540d727e64cc7959d35114b6b1f9c.pdf?index=true
• https://73519f52-b9e0-4218-a76c-7947f55c1fb5.filesusr.com/ugd/c4dbd3_8c78009b6a2d4c0c9468e1db4eac7913.pdf?index=true
• https://6d450e52-f1ba-4a8d-bf88-8d310127289d.filesusr.com/ugd/fbccce_2b1309a197f14dc3968433aff5f9983b.pdf?index=true
• https://f54d6dc2-2cbf-4e4a-9027-63b4b5c13ba8.filesusr.com/ugd/dbbfd0_a551e5a1cfaa4713b728efbf5796de68.pdf?index=true
• https://480cf537-462d-4e93-ad36-699f23de72c6.filesusr.com/ugd/4bb894_73ccad43daf241cbba076310df693ac0.pdf?index=true
• https://1627bbfb-038c-4035-abcd-95ea3ebf546c.filesusr.com/ugd/e2c223_e42ad001a80e4cc6a9f46a6f23a95189.pdf?index=true
• https://7e4f45af-d420-45f4-94ab-c30a9186730d.filesusr.com/ugd/affb4a_a93b074146354212a9da82a5a6be0989.pdf?index=true
• https://3911009e-6656-46ad-b9ac-64ab25acc908.filesusr.com/ugd/01e791_4bb2040991b74dfa9060fbc01739e0e6.pdf?index=true
• https://25ad423c-4871-42e9-b38e-74142acb684f.filesusr.com/ugd/66f3f9_0d8c10e022ac4ab6af92a51a0d61206e.pdf?index=true
• https://0a813c2f-d4b4-4ca0-bc3c-fda8a8ed2b8c.filesusr.com/ugd/b73feb_a7ff298bdd324461bf9195bb2cea7dd5.pdf?index=true
• https://7a6898a9-7e84-41c3-823e-cb98032ad8f7.filesusr.com/ugd/fc840b_5e993a47eabb45429884d7759db84674.pdf?index=true
• https://3de0ff85-bd7d-4b3e-a6b2-fe4e623428e3.filesusr.com/ugd/7c30af_36f8231ad190479eb876ef6c09ca3d35.pdf?index=true
• https://2780e1e7-f1f7-441c-87fb-590e1001d02d.filesusr.com/ugd/911c12_c0480caca87348b6b8d7ceb0775a3cb6.pdf?index=true
• https://e82788b8-1dcf-477c-8f99-a7fa76430f6d.filesusr.com/ugd/9f6a24_78a044a89d234ff3ae2e0e9cda0fba49.pdf?index=true
• https://cdn.shopify.com/s/files/1/0433/7506/7297/files/debevozezexaji.pdf
• https://cdn.shopify.com/s/files/1/0432/1263/6322/files/gaxigizisovugi.pdf
• https://cdn.shopify.com/s/files/1/0433/7310/1214/files/34575835970.pdf
• https://cdn.shopify.com/s/files/1/0437/6802/1141/files/39996973520.pdf
• https://cdn.shopify.com/s/files/1/0440/2990/2998/files/pathfinder_psionics_expanded.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/

Embedded domains

• ttraff.me
• a7a1feca-7dc1-4532-b9d3-4af6d0305216.filesusr.com
• 73519f52-b9e0-4218-a76c-7947f55c1fb5.filesusr.com
• 6d450e52-f1ba-4a8d-bf88-8d310127289d.filesusr.com
• f54d6dc2-2cbf-4e4a-9027-63b4b5c13ba8.filesusr.com
• 480cf537-462d-4e93-ad36-699f23de72c6.filesusr.com
• 1627bbfb-038c-4035-abcd-95ea3ebf546c.filesusr.com
• 7e4f45af-d420-45f4-94ab-c30a9186730d.filesusr.com
• 3911009e-6656-46ad-b9ac-64ab25acc908.filesusr.com
• 25ad423c-4871-42e9-b38e-74142acb684f.filesusr.com
• 0a813c2f-d4b4-4ca0-bc3c-fda8a8ed2b8c.filesusr.com
• 7a6898a9-7e84-41c3-823e-cb98032ad8f7.filesusr.com
• 3de0ff85-bd7d-4b3e-a6b2-fe4e623428e3.filesusr.com
• 2780e1e7-f1f7-441c-87fb-590e1001d02d.filesusr.com
• e82788b8-1dcf-477c-8f99-a7fa76430f6d.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report