MALICIOUS — d2751c_b7b7f96b653e4f27b56116ad95c61f7d.pdf

MALICIOUS — d2751c_b7b7f96b653e4f27b56116ad95c61f7d.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 6728556059ce6c8478ab92d492b67fc5112a35b9f3c899e5ffb5854952939132
• SHA-1: 14c79c698837148b9b9d80d954205a90a143a990
• MD5: 6b5d88a58e4a058851474e73eebf609c
• ssdeep: 768:hgGzpD7OAASrXTcJ6OM+UQnJmeAA+OELv3uxFUYqRdQg8Nmf4cOwQ:SGFnOAiMbQJ1i3CFUxRdN4cOwQ
• TLSH: T1A4339DF32057ED8C768B9B435EEA1148A445D68A7132E6B059887B3CC47C2FDBF10A61
• Submitted as: d2751c_b7b7f96b653e4f27b56116ad95c61f7d.pdf
• File type: pdf · Size: 48119 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=the+heart+of+everything+that+is+pdf, https://ab2ed36b-43d7-4da3-a183-37cefa190441.filesusr.com/ugd/83b1b3_aa12d7b939314218b18cc728830feb68.pdf?index=true, https://1600ca33-195a-483f-8d68-725bc30f3980.filesusr.com/ugd/3be48b_2f8c495ac0f84a23b9de9d821f5a776e.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=the+heart+of+everything+that+is+pdf
• https://ab2ed36b-43d7-4da3-a183-37cefa190441.filesusr.com/ugd/83b1b3_aa12d7b939314218b18cc728830feb68.pdf?index=true
• https://1600ca33-195a-483f-8d68-725bc30f3980.filesusr.com/ugd/3be48b_2f8c495ac0f84a23b9de9d821f5a776e.pdf?index=true
• https://439b743d-8bcb-4035-b626-986e54f850cd.filesusr.com/ugd/54bec1_2de0f7ae7da746c18b6b3671510bcaac.pdf?index=true
• https://cdn.shopify.com/s/files/1/0461/8289/1673/files/chhello_divas_gujarati_film.pdf
• https://cdn.shopify.com/s/files/1/0433/0687/7080/files/noviwuvado.pdf
• https://cdn.shopify.com/s/files/1/0431/3733/5464/files/bakery_business_plan_example.pdf
• https://cdn.shopify.com/s/files/1/0428/3564/0487/files/berlioz_the_bear_activity_sheets.pdf
• https://cdn.shopify.com/s/files/1/0440/8786/9592/files/6th_grade_adding_fractions_worksheet.pdf
• https://6b0d8c10-e643-4386-8d39-e6ec03cb4468.filesusr.com/ugd/b926a8_60c8fcc8023e444eba84a7bca324b687.pdf?index=true
• https://d05e7124-d5b9-4c6a-8dcd-e6afb68ffb50.filesusr.com/ugd/cc3ca9_9382cab2749f45fd968d2d1890d77b56.pdf?index=true
• https://68b84a71-cb74-47a9-bb08-96a6ce105e7f.filesusr.com/ugd/162fe6_7c95826126384ffab572a38794ace0be.pdf?index=true
• https://8debbe1c-4fbd-47b8-a8a2-d45a99a94ad2.filesusr.com/ugd/952c2e_7ceec6dbb0434e1bbe55ecab34d45cb7.pdf?index=true
• https://d49f40c3-add2-43eb-b1d6-d4c8024c4722.filesusr.com/ugd/4725f1_31eb936613be45fea79524e97ddf3c9a.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• ab2ed36b-43d7-4da3-a183-37cefa190441.filesusr.com
• 1600ca33-195a-483f-8d68-725bc30f3980.filesusr.com
• 439b743d-8bcb-4035-b626-986e54f850cd.filesusr.com
• cdn.shopify.com
• 6b0d8c10-e643-4386-8d39-e6ec03cb4468.filesusr.com
• d05e7124-d5b9-4c6a-8dcd-e6afb68ffb50.filesusr.com
• 68b84a71-cb74-47a9-bb08-96a6ce105e7f.filesusr.com
• 8debbe1c-4fbd-47b8-a8a2-d45a99a94ad2.filesusr.com
• d49f40c3-add2-43eb-b1d6-d4c8024c4722.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report