MALICIOUS — 4ca7f5_bbee0deec9e6462fa9402877b6fe0bc1.pdf

MALICIOUS — 4ca7f5_bbee0deec9e6462fa9402877b6fe0bc1.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 67672c7c3e4f089d5d32cd0eff7fd1b7d2f359a5cfad636af134307b410b6f23
• SHA-1: 7994aa83f01ae8db61435a9f271dd9a1e850186d
• MD5: 2a9e9118b007211f76f2e27a36a331aa
• ssdeep: 768:KgGzpDSXtLTImp9/TaPl2JUg0U8uuMkWDkK2rR5d/BUJ3Gb2is/28KkOnWF:XGFiR0U8reDD4XJUJfZBKkOnWF
• TLSH: T112329EF30097ED8D3A8B6F439EAF114D908AC78DA13286641588766CD0BC6FE7F50652
• Submitted as: 4ca7f5_bbee0deec9e6462fa9402877b6fe0bc1.pdf
• File type: pdf · Size: 44184 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=amor+eterno+novela+turca+final, https://cdn.shopify.com/s/files/1/0428/6955/5356/files/ap_world_history_notes.pdf, https://cdn.shopify.com/s/files/1/0438/4777/8469/files/bogoroditse_devo_ttbb.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=amor+eterno+novela+turca+final
• https://cdn.shopify.com/s/files/1/0428/6955/5356/files/ap_world_history_notes.pdf
• https://cdn.shopify.com/s/files/1/0438/4777/8469/files/bogoroditse_devo_ttbb.pdf
• https://cdn.shopify.com/s/files/1/0429/9020/7139/files/pronunciation_guide_french_to_english.pdf
• https://cdn.shopify.com/s/files/1/0460/0525/6353/files/craftsman_chainsaw_manual_18_42cc_manual.pdf
• https://cdn.shopify.com/s/files/1/0431/3127/3383/files/how_to_print_a_2d_array.pdf
• https://cdn.shopify.com/s/files/1/0432/9118/1214/files/16881585341.pdf
• https://cdn.shopify.com/s/files/1/0428/6060/9703/files/6203519126.pdf
• https://6bdceff3-8659-4cb2-aa06-eb963128fe30.filesusr.com/ugd/03ae60_7d3f7f312ce34f688267ba9cc7c301ef.pdf?index=true
• https://31c7586a-ba71-4224-8b58-dbff05aa88b3.filesusr.com/ugd/3be48b_83dcf4891474473fab6dc5d43041a0d6.pdf?index=true
• https://24d3a3ee-d7f7-4481-9b55-4d18185bedc0.filesusr.com/ugd/81d6a4_032d1e814de545359318be58c5404ec7.pdf?index=true
• https://dbbad3d7-5075-4501-bb26-3b5493457a96.filesusr.com/ugd/18f527_ec20d68874224603b333e41ddc4c0d3f.pdf?index=true
• https://2dbef93d-bf23-432e-8b7f-26e684610ef2.filesusr.com/ugd/f390e7_0ef28662976c4175b4202fccd913f642.pdf?index=true
• https://cdn.shopify.com/s/files/1/0433/8266/9475/files/duxivirilezukivoxux.pdf
• https://cdn.shopify.com/s/files/1/0428/9835/8432/files/dutevitijenunolekegek.pdf
• https://cdn.shopify.com/s/files/1/0433/0763/0747/files/flannel_sheets_walmart_king.pdf
• https://cdn.shopify.com/s/files/1/0436/4979/4213/files/gunozigitarivazarotat.pdf
• https://cdn.shopify.com/s/files/1/0435/0682/7429/files/as_3500_free.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• cdn.shopify.com
• 6bdceff3-8659-4cb2-aa06-eb963128fe30.filesusr.com
• 31c7586a-ba71-4224-8b58-dbff05aa88b3.filesusr.com
• 24d3a3ee-d7f7-4481-9b55-4d18185bedc0.filesusr.com
• dbbad3d7-5075-4501-bb26-3b5493457a96.filesusr.com
• 2dbef93d-bf23-432e-8b7f-26e684610ef2.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report