MALICIOUS — 0010c8_08d96352120345feb77cc77efb1580f0.pdf

MALICIOUS — 0010c8_08d96352120345feb77cc77efb1580f0.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 67afc5f0116b2dd3c5de3497c25ee515a3f75a7268187a02cc3421bb58a9c8cc
• SHA-1: 4746dc6cbdadd3b9772e584d5e01e6379c36c166
• MD5: d602e6de2e738e4bafa13fb6f74f776b
• ssdeep: 1536:oQGFGZ+folp77cFx4TOs+U++07a1hYwchLLq/lMfB:odFG1ncrc++rYwiLLslM
• TLSH: T15D38E0F3A477EE0C6A97A7038CDA00581486C74A2137B3A085CCFB6DC4687ADAF51671
• Submitted as: 0010c8_08d96352120345feb77cc77efb1580f0.pdf
• File type: pdf · Size: 82598 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=ninja+saga+talent+guide, https://cdn.shopify.com/s/files/1/0436/0906/3586/files/basic_of_accounting_book.pdf, https://cdn.shopify.com/s/files/1/0462/3607/4133/files/43867816157.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=ninja+saga+talent+guide
• https://cdn.shopify.com/s/files/1/0436/0906/3586/files/basic_of_accounting_book.pdf
• https://cdn.shopify.com/s/files/1/0462/3607/4133/files/43867816157.pdf
• https://cdn.shopify.com/s/files/1/0431/7249/5519/files/67938891101.pdf
• https://cdn.shopify.com/s/files/1/0440/2076/0741/files/30418620945.pdf
• https://cdn.shopify.com/s/files/1/0429/2047/6828/files/what_is_apoptosis.pdf
• https://6711b8ab-0e77-418f-8b0a-4f804b67720e.filesusr.com/ugd/0df15e_ee16e7aa89754a2aa6dc81be4d9054d5.pdf?index=true
• https://4a72625c-5337-4bb1-b640-4e7aa18b2841.filesusr.com/ugd/144d27_ed457d2720a9441d9fc830df9c5f7b38.pdf?index=true
• https://4a657b6c-3a4b-48f5-b2c4-3a0991d0c714.filesusr.com/ugd/868401_0a2d75dbb56345f4a72b45dda9221e3f.pdf?index=true
• https://79e80f0d-d3ce-46b5-886d-2323353f689f.filesusr.com/ugd/501a20_008cb17de2da4968a6c40ab1b2c823d3.pdf?index=true
• https://2f0983f6-c964-484f-9411-e207c5b749e6.filesusr.com/ugd/7ef0dc_a9f0bb89c5dd42c1ae3ddf2ee839190b.pdf?index=true
• https://1b596abc-7c9d-40c6-a544-7b562ea69891.filesusr.com/ugd/217b8a_a86a164b180c46c79265433250116cfe.pdf?index=true
• https://42c45dc6-f9ef-4886-b51b-e0f17296c2d0.filesusr.com/ugd/dc6899_0111a42170eb4c219669d37628e2fc27.pdf?index=true
• https://e46d9a9b-f09b-4d7a-9fae-d282df922345.filesusr.com/ugd/38062a_80ddb655ead849a586610d8dc21a21a1.pdf?index=true
• https://04c19ee5-49da-4592-a105-0d34b4724f26.filesusr.com/ugd/938c70_09cbc33d2e274968b7ad0512757e9fcb.pdf?index=true
• https://4d989acc-49ee-4da1-bcdb-5c2d6974f189.filesusr.com/ugd/843280_4c2737aad3714f9a815848a6d77df043.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• cdn.shopify.com
• 6711b8ab-0e77-418f-8b0a-4f804b67720e.filesusr.com
• 4a72625c-5337-4bb1-b640-4e7aa18b2841.filesusr.com
• 4a657b6c-3a4b-48f5-b2c4-3a0991d0c714.filesusr.com
• 79e80f0d-d3ce-46b5-886d-2323353f689f.filesusr.com
• 2f0983f6-c964-484f-9411-e207c5b749e6.filesusr.com
• 1b596abc-7c9d-40c6-a544-7b562ea69891.filesusr.com
• 42c45dc6-f9ef-4886-b51b-e0f17296c2d0.filesusr.com
• e46d9a9b-f09b-4d7a-9fae-d282df922345.filesusr.com
• 04c19ee5-49da-4592-a105-0d34b4724f26.filesusr.com
• 4d989acc-49ee-4da1-bcdb-5c2d6974f189.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report