MALICIOUS — b13fd1_ca7146a530204089b58e4e5e480dd21c.pdf

MALICIOUS — b13fd1_ca7146a530204089b58e4e5e480dd21c.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 245614e43875b91e63dea349940242f11241630f88622663c717275a7a5b8b01
• SHA-1: 865bbf95d92b29e0c4372d2f95a0351b0524359c
• MD5: 35f8e0750850ae262eca690c13068d2a
• ssdeep: 768:sgGzpD+UkELuAo2bwybUSIoIRU2lVqtIHfctJwBwrkD77PU6WBO:pGF6gIAvtI/6w0kDHxWBO
• TLSH: T143309DF35097EC887ACBAF436EBB10597156D7C92132A67006D93A6CC4787ECAF10960
• Submitted as: b13fd1_ca7146a530204089b58e4e5e480dd21c.pdf
• File type: pdf · Size: 38842 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=wahiawa+elementary+school+map, https://cdn.shopify.com/s/files/1/0435/2439/1071/files/pumpkin_ideas_for_halloween_templates.pdf, https://cdn.shopify.com/s/files/1/0437/4714/7925/files/concepts_of_algorithm_flowchart_and_c_programming.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=wahiawa+elementary+school+map
• https://cdn.shopify.com/s/files/1/0435/2439/1071/files/pumpkin_ideas_for_halloween_templates.pdf
• https://cdn.shopify.com/s/files/1/0437/4714/7925/files/concepts_of_algorithm_flowchart_and_c_programming.pdf
• https://cdn.shopify.com/s/files/1/0427/5663/6828/files/89452019201.pdf
• https://cdn.shopify.com/s/files/1/0481/7636/5719/files/rexakovaruvunu.pdf
• https://cdn.shopify.com/s/files/1/0432/3953/8851/files/sam_2013_access_code_generator.pdf
• https://81bc0d3c-7c2b-4d68-a7ab-19a04a1b13e0.filesusr.com/ugd/24d943_13b786a3d5af4c629fe07b40f051bdfc.pdf?index=true
• https://2142b5d8-ef11-4fa8-b974-8702425e0738.filesusr.com/ugd/c8f33b_e93c9fd9b37b4041a79ec574092ad30f.pdf?index=true
• https://cdn.shopify.com/s/files/1/0428/5402/3327/files/ziviwipatuxomolebizazozi.pdf
• https://cdn.shopify.com/s/files/1/0461/8960/9109/files/petakesavixu.pdf
• https://877cfc73-2659-40c3-8e9a-bb4b57240f60.filesusr.com/ugd/610d21_50e7b275308344ea82075e6e49b5d1cc.pdf?index=true
• https://8a892f84-fc96-4baa-8ca5-d835c1f8378c.filesusr.com/ugd/e3325f_2356872449f346b6bec17da9127c2174.pdf?index=true
• https://9c05afd2-1a8b-43f5-adf8-0587100365ff.filesusr.com/ugd/b463f2_8bf53c5d9c8b4613a31019dbfdb534de.pdf?index=true
• https://d37c8c7d-87c0-463f-b0c1-c5eeb145268c.filesusr.com/ugd/1e52da_a86036318c3f4d59938ff92a3862b9e5.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• cdn.shopify.com
• 81bc0d3c-7c2b-4d68-a7ab-19a04a1b13e0.filesusr.com
• 2142b5d8-ef11-4fa8-b974-8702425e0738.filesusr.com
• 877cfc73-2659-40c3-8e9a-bb4b57240f60.filesusr.com
• 8a892f84-fc96-4baa-8ca5-d835c1f8378c.filesusr.com
• 9c05afd2-1a8b-43f5-adf8-0587100365ff.filesusr.com
• d37c8c7d-87c0-463f-b0c1-c5eeb145268c.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report