MALICIOUS — 724fb5_c439e2f7431e4df4bbe66a6888fb17db.pdf

MALICIOUS — 724fb5_c439e2f7431e4df4bbe66a6888fb17db.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 54 detection engines flagged it.

Identification

• SHA-256: 779e6a7285e6bf9e676d371abfa80e6d0ccd36c23aaf38274e8faf57b90e1f96
• SHA-1: 0b6aa8d4136762b9456ec49c50ef8c4e15ffb185
• MD5: e341210b5d83994d621c494c03332991
• ssdeep: 768:DegGzpDFsMRaUXrkCaPabORveJsgsCIRCZnZGvvzAnr2Qyi4Stae:/GFh+eT7spg5ZeUr2g4Stae
• TLSH: T1A5319EF340ABED4C3A9B9B134EA6525E5145D38D7133A57118D83B6CC0BC7EEAE40A21
• Submitted as: 724fb5_c439e2f7431e4df4bbe66a6888fb17db.pdf
• File type: pdf · Size: 39760 bytes
• Verdict: malicious (78/100)

Detections (2 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=understanding+pathophysiology+6th+edition+study+guide+pdf, https://cdn.shopify.com/s/files/1/0437/3993/8970/files/chain_of_command_definition.pdf, https://cdn.shopify.com/s/files/1/0430/8529/9876/files/twilight_saga_book.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=understanding+pathophysiology+6th+edition+study+guide+pdf
• https://cdn.shopify.com/s/files/1/0437/3993/8970/files/chain_of_command_definition.pdf
• https://cdn.shopify.com/s/files/1/0430/8529/9876/files/twilight_saga_book.pdf
• https://cdn.shopify.com/s/files/1/0433/0881/0398/files/jajusorizebadi.pdf
• https://cdn.shopify.com/s/files/1/0462/3777/8071/files/midas_venice_240_phantom_power.pdf
• https://cdn.shopify.com/s/files/1/0433/0687/7080/files/negopolikutowuz.pdf
• https://6d450e52-f1ba-4a8d-bf88-8d310127289d.filesusr.com/ugd/fbccce_2b1309a197f14dc3968433aff5f9983b.pdf?index=true
• https://92566887-656d-446f-9385-617e10d503ab.filesusr.com/ugd/3d0627_58e32a5bc8c64051b2c9c820bf124b96.pdf?index=true
• https://b7cefcd4-c935-4739-bcb5-470b9a8a3432.filesusr.com/ugd/f515ca_1465ac816c284b6598ff28eb0fab2fd8.pdf?index=true
• https://ab47d8be-0cee-4368-b45d-ab9666cc3d2f.filesusr.com/ugd/3ed44c_bdaed10503a34e6898a0a9e92de52c47.pdf?index=true
• https://e6464bc5-48ec-4aff-a4e3-9df203892aa8.filesusr.com/ugd/02beb7_e410712552e144fba7ef05a57728adc2.pdf?index=true
• https://34881ada-8932-4108-a28f-96b6f6a7a212.filesusr.com/ugd/227d0f_526940e9eb49459a94374669cac9ebb3.pdf?index=true
• https://5bd4ed93-ff6f-43d4-aed8-f646dd6e8831.filesusr.com/ugd/d8966e_56f6f8a7885646fbbe587a7955396897.pdf?index=true
• https://a43f625f-04ab-437d-8137-5da7e577316f.filesusr.com/ugd/3ed902_47104f8cfeb24bbda7c55e774b75da92.pdf?index=true
• https://07083912-2c27-4c12-af74-68758890d8a0.filesusr.com/ugd/60ffa2_fddb0b089cc943bba0dc28bb5f5b72f9.pdf?index=true
• https://80575ec1-ae5b-4f0e-ab6d-9de5b27bed01.filesusr.com/ugd/e643da_c3198a59ce254b1186f096d4412a9967.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• cdn.shopify.com
• 6d450e52-f1ba-4a8d-bf88-8d310127289d.filesusr.com
• 92566887-656d-446f-9385-617e10d503ab.filesusr.com
• b7cefcd4-c935-4739-bcb5-470b9a8a3432.filesusr.com
• ab47d8be-0cee-4368-b45d-ab9666cc3d2f.filesusr.com
• e6464bc5-48ec-4aff-a4e3-9df203892aa8.filesusr.com
• 34881ada-8932-4108-a28f-96b6f6a7a212.filesusr.com
• 5bd4ed93-ff6f-43d4-aed8-f646dd6e8831.filesusr.com
• a43f625f-04ab-437d-8137-5da7e577316f.filesusr.com
• 07083912-2c27-4c12-af74-68758890d8a0.filesusr.com
• 80575ec1-ae5b-4f0e-ab6d-9de5b27bed01.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report