MALICIOUS — 704988_2bc3e8753aa94a7fb1435cda175bac42.pdf
MALICIOUS — 704988_2bc3e8753aa94a7fb1435cda175bac42.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (90/100). 2 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
70843227c65e41b501faadd729524746435b7708e57b357fdaca7aa9fdb55b7c - SHA-1:
0cf41b90024f294399976ffdc79291ca36352c10 - MD5:
ea58a2ed523b9a7bd27e489d122601d1 - ssdeep:
768:HgGzpDj/qTvk19heYNJ5h3UkfmpV2BOlMbDCj1ndOmpF/Rg8+CxOuIU1uwhtT8dD:AGF3/3hh02BgzFdrPO+IIu8tw82 - TLSH:
T1A4339DF35097DDCC36879B03AAE60019A586E6497273E26108D87B6CC43C7BCEE50A30 - Submitted as: 704988_2bc3e8753aa94a7fb1435cda175bac42.pdf
- File type: pdf · Size: 47579 bytes
- Verdict: malicious (90/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The malicious score of 90/100 is the fusion of 6 weighted signals:
- Embedded link rated malicious by URL analysis: https://2a6d2756-33be-485a-8f7c-830f3f5f54f3.filesusr.com/ugd/3f80ec_868ae35c811e432ebd4dc3c80a550085.pdf?index=true - network signal, weight 0.70, confidence 0.80
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ttraff.link/wix?keyword=avengers+endgame+full+movie+watch+online+tamilrockers, https://cdn.shopify.com/s/files/1/0431/4460/9943/files/nenijewapasapejunalitomu.pdf, https://cdn.shopify.com/s/files/1/0432/6286/9670/files/fujegagodobutaleraduso.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.link/wix?keyword=avengers+endgame+full+movie+watch+online+tamilrockers
- https://cdn.shopify.com/s/files/1/0431/4460/9943/files/nenijewapasapejunalitomu.pdf
- https://cdn.shopify.com/s/files/1/0432/6286/9670/files/fujegagodobutaleraduso.pdf
- https://cdn.shopify.com/s/files/1/0433/6631/8230/files/73676382282.pdf
- https://2a6d2756-33be-485a-8f7c-830f3f5f54f3.filesusr.com/ugd/3f80ec_868ae35c811e432ebd4dc3c80a550085.pdf?index=true
- https://b50412b5-6c33-48c8-b49b-6084235b930d.filesusr.com/ugd/18122d_187c2407597748999946d63e5eac4efe.pdf?index=true
- https://700b225d-ad57-4d02-ac0d-75d896144c5a.filesusr.com/ugd/277b62_b31192635e4144759796807fd10aea3f.pdf?index=true
- https://ce82e68c-faba-47b9-b1a4-157973edc370.filesusr.com/ugd/f08e01_388da4a0d0f44daeb2d049f5e9c6cbc3.pdf?index=true
- https://3c5250a1-7932-431e-a4b8-3d1a26519876.filesusr.com/ugd/d43733_ee2dcfbb1af040bcbde25511ce7f6587.pdf?index=true
- https://ba44754d-92ae-46a2-be9e-2d534ab990d9.filesusr.com/ugd/c83fdb_14fe707f964e4124b8fa109dbcaaf301.pdf?index=true
- https://91d86810-6c0e-4bd8-92a7-bc87c2d1c2d3.filesusr.com/ugd/65b209_4b74c10e00674ab9af89e58d202e72d0.pdf?index=true
- https://cdn.shopify.com/s/files/1/0430/3729/4745/files/relijawagovokinadepup.pdf
- https://cdn.shopify.com/s/files/1/0429/6572/9429/files/teriw.pdf
- https://cdn.shopify.com/s/files/1/0427/7701/8524/files/10942677011.pdf
- https://cdn.shopify.com/s/files/1/0430/9113/2577/files/dekamilajavurosego.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/31995481059.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ttraff.link
- cdn.shopify.com
- 2a6d2756-33be-485a-8f7c-830f3f5f54f3.filesusr.com
- b50412b5-6c33-48c8-b49b-6084235b930d.filesusr.com
- 700b225d-ad57-4d02-ac0d-75d896144c5a.filesusr.com
- ce82e68c-faba-47b9-b1a4-157973edc370.filesusr.com
- 3c5250a1-7932-431e-a4b8-3d1a26519876.filesusr.com
- ba44754d-92ae-46a2-be9e-2d534ab990d9.filesusr.com
- 91d86810-6c0e-4bd8-92a7-bc87c2d1c2d3.filesusr.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report