MALICIOUS — f65518_aa8432d0a775474fae10bc79e0af22b0.pdf

MALICIOUS — f65518_aa8432d0a775474fae10bc79e0af22b0.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 7230027e0317707f1023c13e95129c2650c344171051bf17d4301200a36e00b5
• SHA-1: f22c21965124c71c2074bceaca3f249b3ff49828
• MD5: 0cf8ed975cf14981390c4e86593f12e7
• ssdeep: 768:5gGzpDmwL3xKmsdKxKWPMY+XAQfjymB4a/RkNjKLEvNcA0cauAnVyx1:6GFqhywAQfHGNjcEOKFFx1
• TLSH: T1E631ADF3508BED8C7A4B9B03ADF610565148D348A122E77019DD7A6CD4BC2BDAE50EB0
• Submitted as: f65518_aa8432d0a775474fae10bc79e0af22b0.pdf
• File type: pdf · Size: 41052 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=cheats+for+last+day+on+earth, https://cdn.shopify.com/s/files/1/0438/2566/0066/files/alan_moore_jerusalem_download.pdf, https://cdn.shopify.com/s/files/1/0432/8806/8254/files/28301153366.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=cheats+for+last+day+on+earth
• https://cdn.shopify.com/s/files/1/0438/2566/0066/files/alan_moore_jerusalem_download.pdf
• https://cdn.shopify.com/s/files/1/0432/8806/8254/files/28301153366.pdf
• https://cdn.shopify.com/s/files/1/0438/0108/4064/files/english_to_filipino_dictionary.pdf
• https://cdn.shopify.com/s/files/1/0431/3215/8116/files/73693279339.pdf
• https://6c4a7cdf-417c-473b-8798-dfefa4552660.filesusr.com/ugd/1cc7e8_480f057e36194e4a9e19b5420798c748.pdf?index=true
• https://57bdacdb-e8ce-47a7-bdf0-5b322f6ff6ed.filesusr.com/ugd/9757e7_8509173882b645e495e3c7dbafba1909.pdf?index=true
• https://99279593-f1b1-4a93-9f4d-d85ce9672e84.filesusr.com/ugd/f35da0_b2fe797f313c41c3aebdb78388ce5949.pdf?index=true
• https://f89c9433-75eb-4e86-90f6-61ef89f4a7e5.filesusr.com/ugd/370021_d50f821724264002ab3a7516c7df828a.pdf?index=true
• https://93316412-6b65-4450-9f5c-1828a630f5ff.filesusr.com/ugd/7dd30d_30d82030313f45158b9acc8b453ef715.pdf?index=true
• https://7133ca88-2559-495b-af0c-7a7bb9c43431.filesusr.com/ugd/1cc7e8_e16b4e7b487c4806bfac12348a94bc98.pdf?index=true
• https://a736d3eb-5502-46c0-b076-e443d64659ef.filesusr.com/ugd/bdc04d_b1fed4a21fbb470d8df269241a5a12f1.pdf?index=true
• https://cdn.shopify.com/s/files/1/0437/0432/0154/files/narrative_report_in_linggo_ng_wika.pdf
• https://cdn.shopify.com/s/files/1/0434/1760/0157/files/37087717970.pdf
• https://cdn.shopify.com/s/files/1/0430/1724/0733/files/jirit.pdf
• https://cdn.shopify.com/s/files/1/0431/9959/4656/files/50016445746.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• cdn.shopify.com
• 6c4a7cdf-417c-473b-8798-dfefa4552660.filesusr.com
• 57bdacdb-e8ce-47a7-bdf0-5b322f6ff6ed.filesusr.com
• 99279593-f1b1-4a93-9f4d-d85ce9672e84.filesusr.com
• f89c9433-75eb-4e86-90f6-61ef89f4a7e5.filesusr.com
• 93316412-6b65-4450-9f5c-1828a630f5ff.filesusr.com
• 7133ca88-2559-495b-af0c-7a7bb9c43431.filesusr.com
• a736d3eb-5502-46c0-b076-e443d64659ef.filesusr.com
• ai.us
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report