MALICIOUS — 3283b0_77fc5cf9a27e48c6af849d8b7776fe8f.pdf

MALICIOUS — 3283b0_77fc5cf9a27e48c6af849d8b7776fe8f.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 52 detection engines flagged it.

Identification

• SHA-256: 7031f540f54b95656857291de463960cf3d04bff8e2f954fb41b6d9912a5fe4b
• SHA-1: 086ee7d16e8b7608a5d53af7ee6bb3ba57a35674
• MD5: d8f1543b725d187df910125205ee2a15
• ssdeep: 3072:aFg8MEq+0UKPajnhc15Po6isyfis3gffavAW1ZDyHJUuEtKbce:qeEq9a1IPWRgXi11ynh
• TLSH: T1503F01F380EBCC4D76CA9F4369AA1208E4CDC64EA063E7E010CC663ED5AC66D7960571
• Submitted as: 3283b0_77fc5cf9a27e48c6af849d8b7776fe8f.pdf
• File type: pdf · Size: 151384 bytes
• Verdict: malicious (78/100)

Detections (2 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=who+is+lux+wright, https://20eb4712-4e63-4f4b-a78b-8cab0b49b646.filesusr.com/ugd/738632_f5691df292a941ef80bfeca8fcb3390d.pdf?index=true, https://67685957-7f75-467f-9af1-57a3ee944df2.filesusr.com/ugd/e948c1_ca2f29ef07fc472194503c769600dc7a.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=who+is+lux+wright
• https://20eb4712-4e63-4f4b-a78b-8cab0b49b646.filesusr.com/ugd/738632_f5691df292a941ef80bfeca8fcb3390d.pdf?index=true
• https://67685957-7f75-467f-9af1-57a3ee944df2.filesusr.com/ugd/e948c1_ca2f29ef07fc472194503c769600dc7a.pdf?index=true
• https://cef96d5e-0c67-4edd-975a-5d19c8da32d2.filesusr.com/ugd/3f1130_ea20c9138a0c4a4ea080ae6574244e08.pdf?index=true
• https://9ff1e5f7-eaa6-44db-b2a4-82af6c2595d7.filesusr.com/ugd/4b874d_bafc99100d324296b231331692e08fa4.pdf?index=true
• https://ed80d521-bfb1-4335-b157-38bb4caf6bf5.filesusr.com/ugd/3225da_48ff5d9cd38c42ec924f567bd0931800.pdf?index=true
• https://cdn.shopify.com/s/files/1/0465/4166/8502/files/seed_germination_lab_report.pdf
• https://cdn.shopify.com/s/files/1/0432/8184/2341/files/95074365555.pdf
• https://cdn.shopify.com/s/files/1/0431/7193/8461/files/10449874037.pdf
• https://cdn.shopify.com/s/files/1/0429/2286/8892/files/67830671881.pdf
• https://cdn.shopify.com/s/files/1/0430/0180/6997/files/nifez.pdf
• https://cdn.shopify.com/s/files/1/0463/5371/1266/files/termination_letter_due_to_absconding_template.pdf
• https://cdn.shopify.com/s/files/1/0436/9770/1018/files/lufazixojibesekiw.pdf
• https://cdn.shopify.com/s/files/1/0462/7575/6181/files/bengali_song_hemanta_mukhopadhyay.pdf
• https://cdn.shopify.com/s/files/1/0436/2017/1936/files/mukisajifudijos.pdf
• https://cdn.shopify.com/s/files/1/0433/1628/1512/files/vagrant_box_list.pdf
• https://cdn.shopify.com/s/files/1/0438/4437/0594/files/arslantepe_hy.pdf
• https://cdn.shopify.com/s/files/1/0437/0425/4615/files/79762637536.pdf
• https://cdn.shopify.com/s/files/1/0440/7400/8741/files/belajar_bahasa_jepang_lengkap.pdf
• https://cdn.shopify.com/s/files/1/0433/8325/9301/files/aden_and_anais_sleep_sack_size_guide.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/

Embedded domains

• ttraff.ru
• 20eb4712-4e63-4f4b-a78b-8cab0b49b646.filesusr.com
• 67685957-7f75-467f-9af1-57a3ee944df2.filesusr.com
• cef96d5e-0c67-4edd-975a-5d19c8da32d2.filesusr.com
• 9ff1e5f7-eaa6-44db-b2a4-82af6c2595d7.filesusr.com
• ed80d521-bfb1-4335-b157-38bb4caf6bf5.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report