MALICIOUS — d31907_db2dc83c201d460fad0023c5f090e6e0.pdf

MALICIOUS — d31907_db2dc83c201d460fad0023c5f090e6e0.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 43b81ed93b44f8182645107312eca4e0717dae609dba0e84b00ee309b0cec6f6
• SHA-1: fab3e461ecadda0e11778cc69fd72bd321ed8358
• MD5: 7330281e504c110880b728eadef0045c
• ssdeep: 768:ggGzpD8/aWGPw/c/sV/qDRmD9w6aQ8wxtyv3G2+sOS:tGFQYEWmD96Q8wj23G2+sOS
• TLSH: T10E318EF354DBDD8C768B9F07A9AA115CA00AE78C2133AA60459C367CC47C2AD7F50A61
• Submitted as: d31907_db2dc83c201d460fad0023c5f090e6e0.pdf
• File type: pdf · Size: 39965 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=cid+episode+list+imdb, https://09516e45-05ce-40e2-b2f1-57183b735f47.filesusr.com/ugd/0cd3a8_b18c4493d3424e22a83968f326b04559.pdf?index=true, https://e5dc5431-874c-43d7-bda6-c8b012aa281b.filesusr.com/ugd/8a5fcf_e6076286ef3944e291b5c4203fe5accb.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=cid+episode+list+imdb
• https://09516e45-05ce-40e2-b2f1-57183b735f47.filesusr.com/ugd/0cd3a8_b18c4493d3424e22a83968f326b04559.pdf?index=true
• https://e5dc5431-874c-43d7-bda6-c8b012aa281b.filesusr.com/ugd/8a5fcf_e6076286ef3944e291b5c4203fe5accb.pdf?index=true
• https://8c19dabe-adfb-49fa-8959-79e70db2fad0.filesusr.com/ugd/5de1df_82004e3694f341619094216957d54546.pdf?index=true
• https://10192924-2fc6-4bfb-a89c-ad25dcb7ce25.filesusr.com/ugd/29c71c_009cf883be9c419790d83bd02a42ca6e.pdf?index=true
• https://a24c2194-f9ad-4df6-a984-4640697db635.filesusr.com/ugd/0010c8_ee5d24ffa4cc4941ba54ed6b4a361147.pdf?index=true
• https://df14cdb4-5d61-4285-8b41-5c3c95698845.filesusr.com/ugd/e1c37d_b4f5e343049d47d4ac98e4946adb964d.pdf?index=true
• https://cdn.shopify.com/s/files/1/0427/8432/5798/files/the_oxford_dictionary_of_science_fiction.pdf
• https://cdn.shopify.com/s/files/1/0436/1990/9794/files/fepoziseregovabab.pdf
• https://cdn.shopify.com/s/files/1/0432/9809/5272/files/nogut.pdf
• https://cdn.shopify.com/s/files/1/0458/1258/0518/files/gisaloletovimodorolozikem.pdf
• https://cdn.shopify.com/s/files/1/0428/4357/0343/files/92782963490.pdf
• https://e62729a0-9953-4642-a1ac-53cce4257bb6.filesusr.com/ugd/592671_6805ed932a1545bd8492a50e0a4d14d4.pdf?index=true
• https://08e383c0-a579-43ba-b27a-ef0f149ac54f.filesusr.com/ugd/3cb679_3b8ef56e89c644d2bd283353e2362c49.pdf?index=true
• https://3319ca95-d10a-4210-89db-20c5ab7e16a9.filesusr.com/ugd/bdc04d_e93a3b16db9f4be1a8edcbd851589128.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• 09516e45-05ce-40e2-b2f1-57183b735f47.filesusr.com
• e5dc5431-874c-43d7-bda6-c8b012aa281b.filesusr.com
• 8c19dabe-adfb-49fa-8959-79e70db2fad0.filesusr.com
• 10192924-2fc6-4bfb-a89c-ad25dcb7ce25.filesusr.com
• a24c2194-f9ad-4df6-a984-4640697db635.filesusr.com
• df14cdb4-5d61-4285-8b41-5c3c95698845.filesusr.com
• cdn.shopify.com
• e62729a0-9953-4642-a1ac-53cce4257bb6.filesusr.com
• 08e383c0-a579-43ba-b27a-ef0f149ac54f.filesusr.com
• 3319ca95-d10a-4210-89db-20c5ab7e16a9.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report