MALICIOUS — 003b86_95ea7595ea3a478ea4798bcfe53eee29.pdf

MALICIOUS — 003b86_95ea7595ea3a478ea4798bcfe53eee29.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: 620e3cb9e0ce1b2dd9c36f5e0b0671c4f6a4cffe890876cad454de42c1756d2e
• SHA-1: 2638bf724a351332f2fa086296d046e1d6bee378
• MD5: a155359b060f090845d2646ea1479682
• ssdeep: 768:wgGzpDBtbzhEWGn8yysd039g04fjGQK3lrZWAsBprV1xQE495wAiI+:dGFdt6pGtAfj7K3lrZWAI/ITnT+
• TLSH: T1E333BFF354C7EDCCB6879B033EEA01192645E2896173AAA054DD7B7DD07C27DAE10920
• Submitted as: 003b86_95ea7595ea3a478ea4798bcfe53eee29.pdf
• File type: pdf · Size: 49718 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=hd+movie+box+free+online+movies+apk, https://144fcd81-ccb7-4fca-bd99-bb7f0f97e718.filesusr.com/ugd/9d869b_66a04f540b9c44f18e98794422edc97f.pdf?index=true, https://ced8a836-7b1a-4255-9071-fff3db9971df.filesusr.com/ugd/34e21e_692759dd535140e0b0264590951c7ca9.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=hd+movie+box+free+online+movies+apk
• https://144fcd81-ccb7-4fca-bd99-bb7f0f97e718.filesusr.com/ugd/9d869b_66a04f540b9c44f18e98794422edc97f.pdf?index=true
• https://ced8a836-7b1a-4255-9071-fff3db9971df.filesusr.com/ugd/34e21e_692759dd535140e0b0264590951c7ca9.pdf?index=true
• https://bc9fa632-8ea5-4c3f-b548-e27ee5a7d820.filesusr.com/ugd/0fdb6d_13af07f4714942adb47072a4880c5bde.pdf?index=true
• https://c75643bb-38a3-448b-ab0a-20a65ae38c8f.filesusr.com/ugd/7ad284_efbc19ee7dad471a85fe9722179d85a5.pdf?index=true
• https://cdn.shopify.com/s/files/1/0429/9050/2051/files/segufoririseligemejari.pdf
• https://cdn.shopify.com/s/files/1/0431/2308/1373/files/alludu_seenu_video_songs_telugu.pdf
• https://cdn.shopify.com/s/files/1/0434/8900/1638/files/82686064511.pdf
• https://cdn.shopify.com/s/files/1/0433/2801/2456/files/invitation_for_interview_email_template.pdf
• https://cdn.shopify.com/s/files/1/0434/6393/4105/files/mysql_safe_update_mode.pdf
• https://54784421-7987-4ab8-a6c9-9e2d4fe5adcc.filesusr.com/ugd/2813e2_f367a65ea403457a87779c1007af53a9.pdf?index=true
• https://fe0d27a4-6f30-442b-a252-f4c04786ebe1.filesusr.com/ugd/9e41f0_625a28c412b04cfbba69a2b6d202a64c.pdf?index=true
• https://59b3bd42-89ed-40df-ae5e-f0cb3d73e663.filesusr.com/ugd/5ea691_9777379ad7184cdcaff9d3c09325c513.pdf?index=true
• https://8422032e-4020-4806-a76c-7ee7a2f385b0.filesusr.com/ugd/d4a9d6_ee30031560874662bdc95d416a4ef030.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• 144fcd81-ccb7-4fca-bd99-bb7f0f97e718.filesusr.com
• ced8a836-7b1a-4255-9071-fff3db9971df.filesusr.com
• bc9fa632-8ea5-4c3f-b548-e27ee5a7d820.filesusr.com
• c75643bb-38a3-448b-ab0a-20a65ae38c8f.filesusr.com
• cdn.shopify.com
• 54784421-7987-4ab8-a6c9-9e2d4fe5adcc.filesusr.com
• fe0d27a4-6f30-442b-a252-f4c04786ebe1.filesusr.com
• 59b3bd42-89ed-40df-ae5e-f0cb3d73e663.filesusr.com
• 8422032e-4020-4806-a76c-7ee7a2f385b0.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report