MALICIOUS — 429b25_0a7f4b367576443daacf15ff1dc95d66.pdf

MALICIOUS — 429b25_0a7f4b367576443daacf15ff1dc95d66.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 382399a582545596686371864e9185403ef7a4c9de852745a89028843c3ba731
• SHA-1: 264972c484ba08799b517ec56363111ac0dfa362
• MD5: ef4f06a66a5d87cdb756279fb2536b6c
• ssdeep: 768:3gGzpDKJZCgsabZFAhDdgzVs6nlAtmrtDmIswMdIX:QGF+dAh+ps6lAtOtDmIsfdIX
• TLSH: T1C7307CF300DBED8CBA87AB136DE611145589DB8D7132A7A09998777CC47C5BEAF40820
• Submitted as: 429b25_0a7f4b367576443daacf15ff1dc95d66.pdf
• File type: pdf · Size: 38485 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=rdm+qcx+manual, https://8ec93483-2de9-4899-a244-0fa20081817b.filesusr.com/ugd/43d598_d7ac6d8d13d7401e892ab6afde381815.pdf?index=true, https://b7d7ffa1-5335-4062-af3f-fc3ea4af8dc9.filesusr.com/ugd/003b86_26b186966f224fa0b8e752a34638d9ca.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=rdm+qcx+manual
• https://8ec93483-2de9-4899-a244-0fa20081817b.filesusr.com/ugd/43d598_d7ac6d8d13d7401e892ab6afde381815.pdf?index=true
• https://b7d7ffa1-5335-4062-af3f-fc3ea4af8dc9.filesusr.com/ugd/003b86_26b186966f224fa0b8e752a34638d9ca.pdf?index=true
• https://14b2c0ba-2616-421c-9a07-be1518472a74.filesusr.com/ugd/e3325f_ab3d2137e20b43308088e566adedcf70.pdf?index=true
• https://d2d917d8-b052-4c79-b688-88c0a8bb1b64.filesusr.com/ugd/e4f6f0_b1b072dfb7e0419da1513b3dc8471b44.pdf?index=true
• https://c2c8b059-47b4-4e3c-8a9f-9cebc80b2945.filesusr.com/ugd/8acad3_3a972172aff043d5aeaf7a612b21b6ff.pdf?index=true
• https://34bc1bc8-4c92-4913-ac23-764b1b49fe39.filesusr.com/ugd/3ddeef_ca0b765554784f3fa3cb00e8d3dd5f20.pdf?index=true
• https://019e0151-fdc4-494c-b4a0-1e5aaf7a7cfc.filesusr.com/ugd/b148e5_ba5731a52f6243d6a4300206ae47b299.pdf?index=true
• https://0f747ade-1dc6-42a1-8203-e201411c058f.filesusr.com/ugd/e80f4c_3f56cf798b94462394bbb4f468385c79.pdf?index=true
• https://e13a8b0f-cdbb-4ea6-8e26-413b335614fc.filesusr.com/ugd/5ea691_963c9421f94540feb0d1c2b7950de757.pdf?index=true
• https://cdn.shopify.com/s/files/1/0432/4445/4056/files/jee_mains_b_arch_question_paper_download.pdf
• https://cdn.shopify.com/s/files/1/0428/1348/9318/files/jezumibikudejivafexon.pdf
• https://605db03f-8e99-4bb1-a84c-bdaec63a1dfe.filesusr.com/ugd/384ea4_ff096f2566144a639d3b7ba9aaaf6306.pdf?index=true
• https://4b15d451-3b84-4040-ae4e-4253431af1d8.filesusr.com/ugd/e32576_949530aa86d14a2f879aeb97fc770d6d.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• 8ec93483-2de9-4899-a244-0fa20081817b.filesusr.com
• b7d7ffa1-5335-4062-af3f-fc3ea4af8dc9.filesusr.com
• 14b2c0ba-2616-421c-9a07-be1518472a74.filesusr.com
• d2d917d8-b052-4c79-b688-88c0a8bb1b64.filesusr.com
• c2c8b059-47b4-4e3c-8a9f-9cebc80b2945.filesusr.com
• 34bc1bc8-4c92-4913-ac23-764b1b49fe39.filesusr.com
• 019e0151-fdc4-494c-b4a0-1e5aaf7a7cfc.filesusr.com
• 0f747ade-1dc6-42a1-8203-e201411c058f.filesusr.com
• e13a8b0f-cdbb-4ea6-8e26-413b335614fc.filesusr.com
• cdn.shopify.com
• 605db03f-8e99-4bb1-a84c-bdaec63a1dfe.filesusr.com
• 4b15d451-3b84-4040-ae4e-4253431af1d8.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report