MALICIOUS — 6cf0f5_e241c3ff9aeb47d0a4316737b1ad45d3.pdf

MALICIOUS — 6cf0f5_e241c3ff9aeb47d0a4316737b1ad45d3.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 54 detection engines flagged it.

Identification

• SHA-256: 6e47f18f4d4e45a7eee70c3efcebe412c1991201a41f7068697b804276a1aadb
• SHA-1: ad576c4af2faa88e737b03978f911621a5518940
• MD5: d3fd00635c62b09a00c1be9ca2496e0a
• ssdeep: 1536:5GFdeVAjb7bitmC3aIiPaOoMskX+LmXAfeFqS1Ba0IVK/9ZD+YqSAd1:MFd3jb72tmGVpmN+LvexBaxo/9frm
• TLSH: T11838D0F39087EC8C7A87AB0329B521197506D798B132A974948DBB6CC47C3AC6F54E21
• Submitted as: 6cf0f5_e241c3ff9aeb47d0a4316737b1ad45d3.pdf
• File type: pdf · Size: 76678 bytes
• Verdict: malicious (78/100)

Detections (2 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=paper+mario+n64+wad, http://mebetajim.bluethunderbirdwoman.com/uploads/1/3/0/7/130739892/ruwetezare.pdf, http://files.skipelmore.com/uploads/1/3/1/3/131379590/dibujum.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=paper+mario+n64+wad
• http://mebetajim.bluethunderbirdwoman.com/uploads/1/3/0/7/130739892/ruwetezare.pdf
• http://files.skipelmore.com/uploads/1/3/1/3/131379590/dibujum.pdf
• http://nerolejej.creativityandthedivinefeminine.com/uploads/1/3/1/4/131437363/powid-sadijunigopefe.pdf
• https://588c4f28-f06e-4085-882e-939ca294e987.filesusr.com/ugd/c722c2_396cdfae73114d20885f57f9881c3eb0.pdf?index=true
• https://f266762e-ad82-46d7-a4e7-dcc612ede7a6.filesusr.com/ugd/1cc777_547a9a713d91480d91389cd78ff40ddc.pdf?index=true
• https://644741c7-10c1-4c23-be3f-84ce93b5938b.filesusr.com/ugd/227d0f_d04c91705cf94f2993f3080df87512a0.pdf?index=true
• https://911213cb-95bd-44ce-ab8a-bf6d018e9def.filesusr.com/ugd/d2759c_a67df5bdd8ab439fbb5ff1348e21ddad.pdf?index=true
• https://5c027053-4772-4c2e-aba7-dd2d774d78e1.filesusr.com/ugd/dc8a8e_5f3b6f216a884b0ca6a2acff190d9713.pdf?index=true
• http://kebiri.rockcliffetennis.ca/uploads/1/3/0/8/130813747/7493409.pdf
• http://xiwipolud.wbpstars.com/uploads/1/3/0/7/130775612/1988100.pdf
• https://cdn.shopify.com/s/files/1/0433/9331/9079/files/31884593244.pdf
• https://cdn.shopify.com/s/files/1/0430/1576/6177/files/livro_de_administrao_financeira_e_oramentria.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• mebetajim.bluethunderbirdwoman.com
• files.skipelmore.com
• nerolejej.creativityandthedivinefeminine.com
• 588c4f28-f06e-4085-882e-939ca294e987.filesusr.com
• f266762e-ad82-46d7-a4e7-dcc612ede7a6.filesusr.com
• 644741c7-10c1-4c23-be3f-84ce93b5938b.filesusr.com
• 911213cb-95bd-44ce-ab8a-bf6d018e9def.filesusr.com
• 5c027053-4772-4c2e-aba7-dd2d774d78e1.filesusr.com
• kebiri.rockcliffetennis.ca
• xiwipolud.wbpstars.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report