MALICIOUS — 0010c8_28151602c660426ca27acef5f32626c2.pdf

MALICIOUS — 0010c8_28151602c660426ca27acef5f32626c2.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 66f51eb63d5967a33e49330aea62a74692f4bb8eb04d4998768fb2682e8a5800
• SHA-1: acd700f3ee676b0d03f6c95bf4c0f008992a6ab0
• MD5: 68c8724b794c9dd7eee790e7233d76c3
• ssdeep: 1536:tGFmDa6or3Jkd/Dm4Epux/hVj+S9pzpby3a9Q:wFmu6orJkd/6pIfCSn1yAQ
• TLSH: T1B834BFF3945BEE882A876B135DFB11A56088C68CA0325274949D3B2CC47C5FEBF50A31
• Submitted as: 0010c8_28151602c660426ca27acef5f32626c2.pdf
• File type: pdf · Size: 52351 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=microbiology+an+introduction+12th+edition+pdf, https://4c419669-57b7-41c7-9024-a1f9d5324f9b.filesusr.com/ugd/48f461_bdc86f2a4c514bac8fd1c1f4fbf9bdf1.pdf?index=true, https://33f07765-ae8f-4e98-b02d-1c4aeb703797.filesusr.com/ugd/6e2da7_9999ea9799f74b26bd465cc65ca4fe91.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=microbiology+an+introduction+12th+edition+pdf
• https://4c419669-57b7-41c7-9024-a1f9d5324f9b.filesusr.com/ugd/48f461_bdc86f2a4c514bac8fd1c1f4fbf9bdf1.pdf?index=true
• https://33f07765-ae8f-4e98-b02d-1c4aeb703797.filesusr.com/ugd/6e2da7_9999ea9799f74b26bd465cc65ca4fe91.pdf?index=true
• https://c390de48-bc34-4901-9c51-ec7ece1b0fc5.filesusr.com/ugd/fd9558_214dbd58ccec4e088f5db67b76d13688.pdf?index=true
• https://b605ce49-3ab7-47a2-90c2-6dba406840d5.filesusr.com/ugd/37987b_5e72e4c6f7bd4c8da8c0c6d8c72bc9bf.pdf?index=true
• https://8f8381dd-c252-4ec1-900e-73a725ca135e.filesusr.com/ugd/6a7407_a4e547caf4d141c7819255a0d58e0e68.pdf?index=true
• https://5812cc7b-0817-4318-a088-449db664bf08.filesusr.com/ugd/c4f63d_3f5c70be6a9340d68924741c297bdec4.pdf?index=true
• https://099bc257-2eeb-4ba5-a56b-66c72a975a26.filesusr.com/ugd/9d869b_e524c888db84464da3413028b0702a38.pdf?index=true
• https://ec54a790-65ac-4c45-9fc6-df547edc0507.filesusr.com/ugd/3db607_4478b78527fd40aa9565eec0f2ba3485.pdf?index=true
• https://1374a94f-77d9-4514-b155-1300c342f26a.filesusr.com/ugd/7a359d_c54df5b6859c44d4a21e7de07918701f.pdf?index=true
• https://6e488c02-77d3-4f53-afe2-46942bca33c5.filesusr.com/ugd/3f80ec_3de9dc66ce094d9eb8ea1f8c160b7dbe.pdf?index=true
• https://6ea5ddef-f2c9-4338-b1ab-23404c27e6eb.filesusr.com/ugd/35e1ce_c68c2dc37cd540b5b28309ab26753b3e.pdf?index=true
• https://849fb23c-291e-4beb-93b5-da7e1f75f050.filesusr.com/ugd/1d64af_164b24173ec2418abfaebd19c3b9fc58.pdf?index=true
• https://c15f3f55-7348-4d8d-8450-2af3144e29fa.filesusr.com/ugd/a2ebd8_59803fda9bcb4a389c13e9768cea0d19.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• 4c419669-57b7-41c7-9024-a1f9d5324f9b.filesusr.com
• 33f07765-ae8f-4e98-b02d-1c4aeb703797.filesusr.com
• c390de48-bc34-4901-9c51-ec7ece1b0fc5.filesusr.com
• b605ce49-3ab7-47a2-90c2-6dba406840d5.filesusr.com
• 8f8381dd-c252-4ec1-900e-73a725ca135e.filesusr.com
• 5812cc7b-0817-4318-a088-449db664bf08.filesusr.com
• 099bc257-2eeb-4ba5-a56b-66c72a975a26.filesusr.com
• ec54a790-65ac-4c45-9fc6-df547edc0507.filesusr.com
• 1374a94f-77d9-4514-b155-1300c342f26a.filesusr.com
• 6e488c02-77d3-4f53-afe2-46942bca33c5.filesusr.com
• 6ea5ddef-f2c9-4338-b1ab-23404c27e6eb.filesusr.com
• 849fb23c-291e-4beb-93b5-da7e1f75f050.filesusr.com
• c15f3f55-7348-4d8d-8450-2af3144e29fa.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report