MALICIOUS — d2cc1f_ce395aa4b2c7477aaf84f895905db8f4.pdf

MALICIOUS — d2cc1f_ce395aa4b2c7477aaf84f895905db8f4.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 3444e7dab20f51e731b07175e9b096f2d1ed488a120f6c143a69048c7a4d642f
• SHA-1: 0b6df9e35234f23b86d2ac21769764edf8d5e02d
• MD5: 4151dd549b88285a80cdeff21bf43db2
• ssdeep: 768:CgGzpDxUSbVsd4BXtp8RIA4I4WhP6sRz3StOZZna7JRffr:fGFdjtp8z46rzCyZa7Xffr
• TLSH: T1F1318EF39047EC8C7A8A5F036E9B105DA09AD689A137E660189C777CD07C6BDAF40D60
• Submitted as: d2cc1f_ce395aa4b2c7477aaf84f895905db8f4.pdf
• File type: pdf · Size: 41503 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=molecule+polarity+worksheet+answers, https://cdn.shopify.com/s/files/1/0431/9087/8372/files/nujuvusujudiliz.pdf, https://cdn.shopify.com/s/files/1/0432/2213/9041/files/marcus_aurelius_meditations.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=molecule+polarity+worksheet+answers
• https://cdn.shopify.com/s/files/1/0431/9087/8372/files/nujuvusujudiliz.pdf
• https://cdn.shopify.com/s/files/1/0432/2213/9041/files/marcus_aurelius_meditations.pdf
• https://cdn.shopify.com/s/files/1/0440/6460/4310/files/81617137404.pdf
• https://cdn.shopify.com/s/files/1/0433/0507/4838/files/position_velocity_acceleration_worksheet.pdf
• https://37af139d-d5e8-4fe5-80fd-6175ff7a7519.filesusr.com/ugd/24d943_c7bc57b7087d41fdb7467e7c2de6f715.pdf?index=true
• https://ba0d1e03-ce52-4b4f-8aec-7a656d07f774.filesusr.com/ugd/a6e5e9_8cbff5fe7b3945c89a907db2bba36b03.pdf?index=true
• https://7f0dcf6d-1fb4-462c-8d50-c254a85a17a5.filesusr.com/ugd/314c35_e800ff9a1124464388ac4e571cc555ae.pdf?index=true
• https://47f732b5-665f-4ced-b145-12ce2aedc218.filesusr.com/ugd/696117_29d13f01dbae4208870eb28ae2367598.pdf?index=true
• https://ab0547ff-eed0-4e8a-8015-248574eac7a2.filesusr.com/ugd/227d0f_403e51994e2b4c43a41f0a6834dbe8dc.pdf?index=true
• https://68b55123-f390-4a4e-9d51-c6052283c3f5.filesusr.com/ugd/868b90_fc056abad9444cc08590c77cd1135e00.pdf?index=true
• https://9418ef09-3650-44c4-9a94-bb76510c54fb.filesusr.com/ugd/fedf23_d5b0584bb6aa4e95816f01442d41368b.pdf?index=true
• https://a7cb132e-9eeb-4673-9f67-890a7e7fbbd2.filesusr.com/ugd/1acd69_108b14161f68405488acab68eb9dfebf.pdf?index=true
• https://9d595ece-74e5-4f42-b608-5d6e977d65df.filesusr.com/ugd/1a1092_4de2d0e36bef4ee59fafb21ff88b2233.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• cdn.shopify.com
• 37af139d-d5e8-4fe5-80fd-6175ff7a7519.filesusr.com
• ba0d1e03-ce52-4b4f-8aec-7a656d07f774.filesusr.com
• 7f0dcf6d-1fb4-462c-8d50-c254a85a17a5.filesusr.com
• 47f732b5-665f-4ced-b145-12ce2aedc218.filesusr.com
• ab0547ff-eed0-4e8a-8015-248574eac7a2.filesusr.com
• 68b55123-f390-4a4e-9d51-c6052283c3f5.filesusr.com
• 9418ef09-3650-44c4-9a94-bb76510c54fb.filesusr.com
• a7cb132e-9eeb-4673-9f67-890a7e7fbbd2.filesusr.com
• 9d595ece-74e5-4f42-b608-5d6e977d65df.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report