MALICIOUS — 66f3f9_bffe1af7baff4b178f9ce4472b31b8fb.pdf

MALICIOUS — 66f3f9_bffe1af7baff4b178f9ce4472b31b8fb.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 53aa09ea4daefc12effc40e027b824b006fb15ee9c501ef83d34451a8249c542
• SHA-1: 63ba25e4ef81848c75a0e43c6460140b09c43d15
• MD5: 53cda13bb2dfe35af268b7ab4bfe045f
• ssdeep: 768:/XgGzpD0ILUIuLjYbnFGM1tjFw2RzmzH8Xp5Lv6nwRIJlB:YGFwI2M1MSmwDLv6nwmJlB
• TLSH: T1CB318EF3119BDD8C3AC69F536EEA20096545DB896023AA744498773CC4BC2FDBF50A60
• Submitted as: 66f3f9_bffe1af7baff4b178f9ce4472b31b8fb.pdf
• File type: pdf · Size: 42278 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=fe+civil+review+manual+latest+edition, https://debb85a6-ce8c-48d1-9ccb-c6332eda7b0d.filesusr.com/ugd/a421e3_5ba07724fc08432b9ba9e9967d4407bb.pdf?index=true, https://b3762439-1887-431d-9920-5101aa87abfd.filesusr.com/ugd/610d21_d57f377e600346f7bb27bd58532bbbcb.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=fe+civil+review+manual+latest+edition
• https://debb85a6-ce8c-48d1-9ccb-c6332eda7b0d.filesusr.com/ugd/a421e3_5ba07724fc08432b9ba9e9967d4407bb.pdf?index=true
• https://b3762439-1887-431d-9920-5101aa87abfd.filesusr.com/ugd/610d21_d57f377e600346f7bb27bd58532bbbcb.pdf?index=true
• https://684f2967-68c0-47e8-8385-0414401560a0.filesusr.com/ugd/031dda_074db1f2082f43c69ea25643ff7390d6.pdf?index=true
• https://060badb2-51c6-40fe-b811-b3ea9c6ce1e7.filesusr.com/ugd/02631b_a1a61ea8976c4aebaa3d149f23d2f2ce.pdf?index=true
• https://ad306660-fe55-4abc-8c9c-324e857d6e2e.filesusr.com/ugd/bc0b97_4cb2a48d8e1f4d3a85a3e535f48919ae.pdf?index=true
• https://e296a1d4-4dc4-4673-955f-104e027b48bc.filesusr.com/ugd/c57cae_078eed16dc894fe796e1f470fda586ab.pdf?index=true
• https://a9d3945f-d792-46ba-97bf-f1761a0cbd34.filesusr.com/ugd/95089d_96b524dd8fdc4e45b7d81ff47c527d61.pdf?index=true
• https://cdn.shopify.com/s/files/1/0436/8341/4169/files/57784413693.pdf
• https://cdn.shopify.com/s/files/1/0427/8360/4903/files/mukhyamantri_awas_yojana_form_rajkot.pdf
• https://cdn.shopify.com/s/files/1/0486/4101/5966/files/lufawexatokezugonaw.pdf
• https://cdn.shopify.com/s/files/1/0431/7764/0092/files/26168865151.pdf
• https://cdn.shopify.com/s/files/1/0468/0361/5893/files/45578038982.pdf
• https://7bd9aed0-01d6-416e-8f73-93c5a47e323c.filesusr.com/ugd/a31856_4d5209ad135e4682b5edef305a2eedca.pdf?index=true
• https://950884b1-ffd6-4567-a5e5-00e88a50be52.filesusr.com/ugd/dcc11b_cf0cf3fc05094bcbbc11a53211f151f4.pdf?index=true
• https://8984a4d5-0b86-454b-bca8-856336644f51.filesusr.com/ugd/33a16d_a09fec118b7b4fdfbcd591183b5c186a.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• debb85a6-ce8c-48d1-9ccb-c6332eda7b0d.filesusr.com
• b3762439-1887-431d-9920-5101aa87abfd.filesusr.com
• 684f2967-68c0-47e8-8385-0414401560a0.filesusr.com
• 060badb2-51c6-40fe-b811-b3ea9c6ce1e7.filesusr.com
• ad306660-fe55-4abc-8c9c-324e857d6e2e.filesusr.com
• e296a1d4-4dc4-4673-955f-104e027b48bc.filesusr.com
• a9d3945f-d792-46ba-97bf-f1761a0cbd34.filesusr.com
• cdn.shopify.com
• 7bd9aed0-01d6-416e-8f73-93c5a47e323c.filesusr.com
• 950884b1-ffd6-4567-a5e5-00e88a50be52.filesusr.com
• 8984a4d5-0b86-454b-bca8-856336644f51.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report