MALICIOUS — a8ca0f_69bceb490dd64b78811aa00d76ed172b.pdf

MALICIOUS — a8ca0f_69bceb490dd64b78811aa00d76ed172b.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 24878abcbd2460b5bc75eaf5241dea1fe3845e5d578ed5c0f0eb5de7c2eccdda
• SHA-1: 884bcc873366727cb4e1e4c7bf71af9362df356a
• MD5: 35f425093bb1a77740c245ffa6a05f46
• ssdeep: 1536:NGFkY3WIutQ0/AFGbLwLm4kavZ1aFXCpjPX:QFkYG9f3wS4k4aFcz
• TLSH: T1AA35C0F314E7ED4E7BC16B071EAE00891645E7086223D6A1555C777CE0FC2BEAE14A21
• Submitted as: a8ca0f_69bceb490dd64b78811aa00d76ed172b.pdf
• File type: pdf · Size: 63016 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=lds+manual+sunday+school, https://cdn.shopify.com/s/files/1/0464/7095/5166/files/bewupapofabuwimiz.pdf, https://cdn.shopify.com/s/files/1/0430/7383/1072/files/18186240676.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=lds+manual+sunday+school
• https://cdn.shopify.com/s/files/1/0464/7095/5166/files/bewupapofabuwimiz.pdf
• https://cdn.shopify.com/s/files/1/0430/7383/1072/files/18186240676.pdf
• https://cdn.shopify.com/s/files/1/0434/8523/3304/files/79955704487.pdf
• https://cdn.shopify.com/s/files/1/0433/8181/7505/files/chase_arbitration_opt_out_date.pdf
• https://cdn.shopify.com/s/files/1/0437/4098/7543/files/english_listening_files_free.pdf
• https://cdn.shopify.com/s/files/1/0430/1396/3939/files/lofubotinilevijofafifar.pdf
• https://cdn.shopify.com/s/files/1/0428/9835/8432/files/mozesuseb.pdf
• https://cdn.shopify.com/s/files/1/0429/2119/7724/files/84487079960.pdf
• https://aab679b9-3c66-4b22-b1c1-61ad326bc28f.filesusr.com/ugd/1e52da_d26d036f66244b2bb871c05c5f9c5fce.pdf?index=true
• https://ccb5a1c1-d4f3-4b4e-b1b9-e6205b3819f7.filesusr.com/ugd/625844_5b4576f0b894496a8e5438d2dee0a6bb.pdf?index=true
• https://7e954b61-bd7c-4417-a1e8-a242c18b84ac.filesusr.com/ugd/bba345_68be99421f104651828b5b96de6909e1.pdf?index=true
• https://eac4242b-4fde-4c5e-bef1-2ef9a76a9be4.filesusr.com/ugd/6f5f23_4d68d85578d347aabff3fb0d98a8d00b.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• cdn.shopify.com
• aab679b9-3c66-4b22-b1c1-61ad326bc28f.filesusr.com
• ccb5a1c1-d4f3-4b4e-b1b9-e6205b3819f7.filesusr.com
• 7e954b61-bd7c-4417-a1e8-a242c18b84ac.filesusr.com
• eac4242b-4fde-4c5e-bef1-2ef9a76a9be4.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report