MALICIOUS — 9ff9b8_73c837dc42024d96a05f8b12d3081f8a.pdf

MALICIOUS — 9ff9b8_73c837dc42024d96a05f8b12d3081f8a.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 6774603494c6dffa0358a507cc24c0395240a9cf62651c8aae717d0458e11918
• SHA-1: e332ef847364a144499ea04f15481495dc3ae538
• MD5: 7abbbdf46960a868daa56174d54e7866
• ssdeep: 768:JgGzpDmXObC4y8a8Y+KTYfPFbS9c9Y0AdX3jtBXbcLVyL09L8:qGFCXCLY+K6O1jXro9L8
• TLSH: T198328DF311BBED8D378ADB03A9EA20189449D7885032A62055D97B3CC4BC7BDBF40950
• Submitted as: 9ff9b8_73c837dc42024d96a05f8b12d3081f8a.pdf
• File type: pdf · Size: 46120 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=spoof+caller+id+cracked+apk, https://eb295520-c40f-4906-b39c-4f519d284d35.filesusr.com/ugd/70094d_981cc225b4dc4a28b4444a839dbcdb6c.pdf?index=true, https://86995389-6351-4648-a326-c6fd2b28faa3.filesusr.com/ugd/3f2390_c5bb53b86ade42e780893c7e83cce54a.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=spoof+caller+id+cracked+apk
• https://eb295520-c40f-4906-b39c-4f519d284d35.filesusr.com/ugd/70094d_981cc225b4dc4a28b4444a839dbcdb6c.pdf?index=true
• https://86995389-6351-4648-a326-c6fd2b28faa3.filesusr.com/ugd/3f2390_c5bb53b86ade42e780893c7e83cce54a.pdf?index=true
• https://96ae3ede-bf9f-4dfe-9d32-7bc7c224eafb.filesusr.com/ugd/930050_de83b89bf340488293eb7f204c0f1142.pdf?index=true
• https://cdn.shopify.com/s/files/1/0429/7441/2949/files/gonof.pdf
• https://cdn.shopify.com/s/files/1/0433/2558/7609/files/21912561525.pdf
• https://cdn.shopify.com/s/files/1/0430/8349/7623/files/vuwiz.pdf
• https://cdn.shopify.com/s/files/1/0432/6889/8966/files/43953255520.pdf
• https://cdn.shopify.com/s/files/1/0432/4986/0765/files/18943700297.pdf
• https://bdd8dc8a-219e-49cb-95eb-0bdc69b010eb.filesusr.com/ugd/8acad3_60cff46ba51f49768f76219e23fb0d9c.pdf?index=true
• https://2955fe57-e3b0-4e6b-a2e9-9705be2c5b38.filesusr.com/ugd/2eedf1_6e23a5f1567241d7b7f619f75b6f9009.pdf?index=true
• https://7fe4dfb4-453c-487b-8f70-0cda3277f844.filesusr.com/ugd/d2cc1f_2987dc0471cf4cb48f65d392d153ad1e.pdf?index=true
• https://c46cd773-ae22-43ca-b0f2-dc12a622613d.filesusr.com/ugd/b1b3ad_94a7a9c057364800898b198e093711e1.pdf?index=true
• https://8089c79c-082f-4662-aded-2f3ebc04e044.filesusr.com/ugd/bb10c5_6eba541eb89f4ef9aee3a8fe7c560c4d.pdf?index=true
• https://37354c80-d7c7-4261-a478-2644e423de08.filesusr.com/ugd/8f6098_aebbbedf35ff452c9f61632d9fcadc40.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• eb295520-c40f-4906-b39c-4f519d284d35.filesusr.com
• 86995389-6351-4648-a326-c6fd2b28faa3.filesusr.com
• 96ae3ede-bf9f-4dfe-9d32-7bc7c224eafb.filesusr.com
• cdn.shopify.com
• bdd8dc8a-219e-49cb-95eb-0bdc69b010eb.filesusr.com
• 2955fe57-e3b0-4e6b-a2e9-9705be2c5b38.filesusr.com
• 7fe4dfb4-453c-487b-8f70-0cda3277f844.filesusr.com
• c46cd773-ae22-43ca-b0f2-dc12a622613d.filesusr.com
• 8089c79c-082f-4662-aded-2f3ebc04e044.filesusr.com
• 37354c80-d7c7-4261-a478-2644e423de08.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report