MALICIOUS — cec570_306f671ede634109a9af3b3486aff4cc.pdf

MALICIOUS — cec570_306f671ede634109a9af3b3486aff4cc.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 388b58b922e35d1b6b4155cd19daeea57a60c6900a183604ee38299629e8f0c9
• SHA-1: 48302e66277c41f355d35254c5016a78b9e5907d
• MD5: 13e63973d3e2bb726f59f6f6bd5d62d2
• ssdeep: 768:igGzpDSEYg4oqIX40uvkY3WWNxRAwaCeiH5K3CTYgbXrSRlK:/GFWgMkY3TNxRbeiH5KyVbWRlK
• TLSH: T1EB319CF31097ED8C7687AF039AA7019A6146D6CD6126E6A009D97B3CC4BC7FC6E01631
• Submitted as: cec570_306f671ede634109a9af3b3486aff4cc.pdf
• File type: pdf · Size: 40360 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=timex+1440+sports+watch+instructions+military+time, https://cdn.shopify.com/s/files/1/0430/3332/9815/files/72147049872.pdf, https://cdn.shopify.com/s/files/1/0435/4362/5880/files/82167403407.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=timex+1440+sports+watch+instructions+military+time
• https://cdn.shopify.com/s/files/1/0430/3332/9815/files/72147049872.pdf
• https://cdn.shopify.com/s/files/1/0435/4362/5880/files/82167403407.pdf
• https://cdn.shopify.com/s/files/1/0438/2674/1405/files/jigozurevapenidaton.pdf
• https://cdn.shopify.com/s/files/1/0433/8978/0124/files/18011455206.pdf
• https://cdn.shopify.com/s/files/1/0437/5887/8881/files/a_league_tv_guide_for_tonight.pdf
• https://eac62c59-ee09-4e2a-b473-e72edf2c4cd8.filesusr.com/ugd/e0d0cf_e8d3a19f6d1247d0abc953aea2f7117f.pdf?index=true
• https://f5bbabdb-4eed-47c3-87ee-c3c6130e7439.filesusr.com/ugd/f09a9d_6b611f0487354dd3b8e5a4054a395913.pdf?index=true
• https://f9eee19c-31ce-4ab3-8d88-8d951cd99ff9.filesusr.com/ugd/3a38e0_3f4cbedd6dec4ee59111221966b13d97.pdf?index=true
• https://cdn.shopify.com/s/files/1/0434/8506/9477/files/gmbinder_formatting_guide.pdf
• https://cdn.shopify.com/s/files/1/0433/7565/7125/files/triple_integrals_in_cylindrical_and_spherical_coordinates.pdf
• https://4606810b-15d3-46a0-a403-265d0d35c089.filesusr.com/ugd/610d21_70fb0881d49b4ebcaef7af994eb28816.pdf?index=true
• https://3e55e5b3-b86e-4f25-b89f-4423fa58ad52.filesusr.com/ugd/ad2ade_230963c4604d4a1683e2b47db127def7.pdf?index=true
• https://cec4ff9d-094f-47f1-b044-2e178dc896de.filesusr.com/ugd/c88839_5c2ef7e861c74b418708c99aba50b133.pdf?index=true
• https://58330a1c-6363-4e61-9d74-a9549eecf02f.filesusr.com/ugd/daca0d_7c0ce997a401413f988d6afbbc54e7c3.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• cdn.shopify.com
• eac62c59-ee09-4e2a-b473-e72edf2c4cd8.filesusr.com
• f5bbabdb-4eed-47c3-87ee-c3c6130e7439.filesusr.com
• f9eee19c-31ce-4ab3-8d88-8d951cd99ff9.filesusr.com
• 4606810b-15d3-46a0-a403-265d0d35c089.filesusr.com
• 3e55e5b3-b86e-4f25-b89f-4423fa58ad52.filesusr.com
• cec4ff9d-094f-47f1-b044-2e178dc896de.filesusr.com
• 58330a1c-6363-4e61-9d74-a9549eecf02f.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report