MALICIOUS — 3a38e0_63d9a1e4d496425baf055bf406b567fc.pdf

MALICIOUS — 3a38e0_63d9a1e4d496425baf055bf406b567fc.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 36b177cf4de70fa0ca2a4989a781e7b0889108b4c166d7f8ba7e67333b62fa7a
• SHA-1: 4574ca3e156311fae9da2e33c76d11aa45404ef4
• MD5: 54a2a6dc9cf5882134af0b843dce70a0
• ssdeep: 1536:cGF1e7Mt8nee6qEMaUOgXE6UC9X0pO/AQm1eYgpxAs3fuM:5F1ft8ne96OgXERCVzdkJgTAs3h
• TLSH: T19038D0F354B7DE8838879F936AEA115DA149AE492027EA7404C83B5CC07C1FE7F80956
• Submitted as: 3a38e0_63d9a1e4d496425baf055bf406b567fc.pdf
• File type: pdf · Size: 78594 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=die+physiker+interpretation+pdf, https://c6091fb0-81ca-4279-aed0-0b0f8e3ac93e.filesusr.com/ugd/3be48b_87363d1a7e2a43149a7ad1891f8a74cc.pdf?index=true, https://2e93e22a-fb7b-4908-93ee-764cfb329472.filesusr.com/ugd/f1780b_ff1a734639b543dfa371c6871c66c037.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=die+physiker+interpretation+pdf
• https://c6091fb0-81ca-4279-aed0-0b0f8e3ac93e.filesusr.com/ugd/3be48b_87363d1a7e2a43149a7ad1891f8a74cc.pdf?index=true
• https://2e93e22a-fb7b-4908-93ee-764cfb329472.filesusr.com/ugd/f1780b_ff1a734639b543dfa371c6871c66c037.pdf?index=true
• https://f8d0f44c-25a0-4ca5-b06d-6bdc3b4c4336.filesusr.com/ugd/dcf311_e35930474a854d909e277cd7fefdefc3.pdf?index=true
• https://9c6f0df0-4918-4220-8be5-d4b8cc3b20b6.filesusr.com/ugd/dcf311_bfbd33e20a804fa09b269749c2a18b2e.pdf?index=true
• https://458c503a-0541-42ec-b078-352dbb278c30.filesusr.com/ugd/dc8a8e_242d40f6819b455b90d5c7ab55b12267.pdf?index=true
• https://a07e99dd-f70e-4608-8bb3-00522da1158b.filesusr.com/ugd/610d21_b0bf181289374df5b36f23596b9b5271.pdf?index=true
• https://1a91a79e-f885-43c3-87b0-d64624f4ed16.filesusr.com/ugd/d6af85_8633ec0c4ccb47e995b29b64dcc5eba7.pdf?index=true
• https://cdn.shopify.com/s/files/1/0433/5825/7306/files/fezusodibezu.pdf
• https://cdn.shopify.com/s/files/1/0484/0990/3264/files/75990124096.pdf
• https://f6e319a4-713a-483d-b235-f73977ff8f3b.filesusr.com/ugd/974a4e_5a74700a305941d9a01613f9387fe289.pdf?index=true
• https://5a7b2df5-c6f4-4864-9373-47ec193ddce9.filesusr.com/ugd/98e2de_b48ad7a3f0be4bb38b1de0179dbfa191.pdf?index=true
• https://00f72ef0-907d-4a69-95d0-2f175d0c377e.filesusr.com/ugd/a91264_14cf0d1e2f5640c1b669b4658cdd52f7.pdf?index=true
• https://15adb5f8-d13a-4e08-98c4-38570716bccb.filesusr.com/ugd/33ab24_924de9c6e5e446808e0a859bb0e8d2b7.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• c6091fb0-81ca-4279-aed0-0b0f8e3ac93e.filesusr.com
• 2e93e22a-fb7b-4908-93ee-764cfb329472.filesusr.com
• f8d0f44c-25a0-4ca5-b06d-6bdc3b4c4336.filesusr.com
• 9c6f0df0-4918-4220-8be5-d4b8cc3b20b6.filesusr.com
• 458c503a-0541-42ec-b078-352dbb278c30.filesusr.com
• a07e99dd-f70e-4608-8bb3-00522da1158b.filesusr.com
• 1a91a79e-f885-43c3-87b0-d64624f4ed16.filesusr.com
• cdn.shopify.com
• f6e319a4-713a-483d-b235-f73977ff8f3b.filesusr.com
• 5a7b2df5-c6f4-4864-9373-47ec193ddce9.filesusr.com
• 00f72ef0-907d-4a69-95d0-2f175d0c377e.filesusr.com
• 15adb5f8-d13a-4e08-98c4-38570716bccb.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report