MALICIOUS — bcc0e4_ebe08071cf9b465ba3b5c02688e18808.pdf

MALICIOUS — bcc0e4_ebe08071cf9b465ba3b5c02688e18808.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 478c63a2487b76ff64dd83921915e9a98b5c02f443d80e022c14429b00b92495
SHA-1: cc00fe70e5272571035e36f8d55324b49fa0bf90
MD5: 3655fd8f39dcbedbe1624f76e46831c2
ssdeep: 1536:+GFQn3heefwtKG089dOP4BU7QkOn6GGjDAa2EipsYeISEzWHlNuVQTzR:nFQsshxQNnvGOE07eVEylNuwF
TLSH: T1AF38CFF310ABDD4CB78B9F439EF718499142E78A71326B604488776CC8786BD9E51E20
Submitted as: bcc0e4_ebe08071cf9b465ba3b5c02688e18808.pdf
File type: pdf · Size: 83757 bytes
Verdict: malicious (78/100)

Detections (2 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ttraff.link/wix?keyword=plate+tectonics+vocabulary+worksheet+pdf, https://fc8cdd5b-7572-4ecc-b0b0-dadd2f6fcfe6.filesusr.com/ugd/f2ef67_3267332022804106b82f4cae825ffba1.pdf?index=true, https://12bfd732-7687-4955-9476-ad647f841298.filesusr.com/ugd/dec231_ec35c81168ad4fb194681389d1a01238.pdf?index=true - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

1132 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://ttraff.link/wix?keyword=plate+tectonics+vocabulary+worksheet+pdf
https://fc8cdd5b-7572-4ecc-b0b0-dadd2f6fcfe6.filesusr.com/ugd/f2ef67_3267332022804106b82f4cae825ffba1.pdf?index=true
https://12bfd732-7687-4955-9476-ad647f841298.filesusr.com/ugd/dec231_ec35c81168ad4fb194681389d1a01238.pdf?index=true
https://47f7d3a8-a61f-4c0b-94c8-2299b86cc008.filesusr.com/ugd/f1780b_663b1be722764119ab49021767afe161.pdf?index=true
https://d30b47ba-3174-4404-b3cc-a77b18f7c61e.filesusr.com/ugd/d1c05f_a90809761e4a41deb645b040c380effc.pdf?index=true
http://wofina.tuckantugs.com/uploads/1/3/0/8/130813765/jukorosiliw-neripevajej-mowugag-vubaxa.pdf
http://sirajuw.blackgirlscode.com/uploads/1/3/1/6/131607110/160881.pdf
http://padurotut.incubator143.org/uploads/1/3/1/3/131379394/4068087.pdf
http://maxope.johnhayalumni.com/uploads/1/3/0/8/130813490/17014.pdf
http://files.rgdd-darkdesigns.com/uploads/1/3/1/4/131455543/8782152.pdf
https://cdn.shopify.com/s/files/1/0434/5505/3989/files/bcdedit._exe_for_xp.pdf
https://cdn.shopify.com/s/files/1/0430/8933/0330/files/41303251793.pdf
https://cdn.shopify.com/s/files/1/0463/6160/8347/files/79637439712.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ttraff.link
fc8cdd5b-7572-4ecc-b0b0-dadd2f6fcfe6.filesusr.com
12bfd732-7687-4955-9476-ad647f841298.filesusr.com
47f7d3a8-a61f-4c0b-94c8-2299b86cc008.filesusr.com
d30b47ba-3174-4404-b3cc-a77b18f7c61e.filesusr.com
wofina.tuckantugs.com
sirajuw.blackgirlscode.com
padurotut.incubator143.org
maxope.johnhayalumni.com
files.rgdd-darkdesigns.com
cdn.shopify.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report