MALICIOUS — fb41f9_eaeb3c8a73cd4a72b49f30096d4bc0c9.pdf

MALICIOUS — fb41f9_eaeb3c8a73cd4a72b49f30096d4bc0c9.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 8550ac5687b1eaf2d8c038320a877178fbab55e60f06cf1a9aa139958a218199
• SHA-1: b2b52ce5af6becac0b1edd5fe9b5038d148cc67f
• MD5: a993ad1dc9b45d0c07d1ae03e123fe8f
• ssdeep: 768:JgGzpDA0e1EFb7oUONdTfZXSKSO9wN1dXd7xDY6S/q8E1fp6:qGFUp//9wN1j7xDabgp6
• TLSH: T1D02F8EF3219BEC8C7949AB537ED601192086D9CC6133E6610898766CC07C6FD6F10AB2
• Submitted as: fb41f9_eaeb3c8a73cd4a72b49f30096d4bc0c9.pdf
• File type: pdf · Size: 34458 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=dooney+and+bourke+florentine+chelsea+shopper, https://cdn.shopify.com/s/files/1/0428/9835/8432/files/71340125447.pdf, https://cdn.shopify.com/s/files/1/0431/7826/2689/files/une_tempete_aime_cesaire_french.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=dooney+and+bourke+florentine+chelsea+shopper
• https://cdn.shopify.com/s/files/1/0428/9835/8432/files/71340125447.pdf
• https://cdn.shopify.com/s/files/1/0431/7826/2689/files/une_tempete_aime_cesaire_french.pdf
• https://cdn.shopify.com/s/files/1/0433/3764/6245/files/the_circle_maker.pdf
• https://cdn.shopify.com/s/files/1/0437/7142/9016/files/58771054686.pdf
• https://cdn.shopify.com/s/files/1/0437/4691/8551/files/advanced_bestiary.pdf
• https://cdn.shopify.com/s/files/1/0440/2708/4965/files/boutique_logo_vector_file_free.pdf
• https://cdn.shopify.com/s/files/1/0431/0063/5290/files/convert_mkv_to_mp3.pdf
• https://cdn.shopify.com/s/files/1/0467/7812/2393/files/tokagigavebuf.pdf
• https://cdn.shopify.com/s/files/1/0484/8002/6774/files/real_estate_transaction_flow_chart.pdf
• https://6ec356e8-27cb-47f5-b8d1-2cfaeece3a64.filesusr.com/ugd/405339_b1af43b0f3b64a8a8cd30bd2dd1648b5.pdf?index=true
• https://659540f9-52e0-457d-9966-7c6bdf671600.filesusr.com/ugd/a8cc01_afdc20a6ee6c4dac99d19c9af059d819.pdf?index=true
• https://466061d8-1c0b-460e-b62b-f171f68f5cd5.filesusr.com/ugd/0cd019_f7d39892de9c48889ab627f2c186d704.pdf?index=true
• https://96817aa3-c550-4b4f-9e06-6fc8238cc97f.filesusr.com/ugd/2eec94_774b3e60023f4a1b8e054f15d2f5f118.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• cdn.shopify.com
• 6ec356e8-27cb-47f5-b8d1-2cfaeece3a64.filesusr.com
• 659540f9-52e0-457d-9966-7c6bdf671600.filesusr.com
• 466061d8-1c0b-460e-b62b-f171f68f5cd5.filesusr.com
• 96817aa3-c550-4b4f-9e06-6fc8238cc97f.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report