MALICIOUS — 0c8cc8_68fad3188276428db6cb9840da2f55d4.pdf

MALICIOUS — 0c8cc8_68fad3188276428db6cb9840da2f55d4.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 86fbb70761f111f8b565c2f3d8d462a730c7080207890203d7dcbc01a0d80512
• SHA-1: 29d9f0c105f33014f0bf26265015863c5f7cdc2e
• MD5: 07b0b8c32520211c258cdf7951abd03b
• ssdeep: 768:wgGzpD8sHEd3XUsEfGL5v/CTk3KVa1VtY000FhWN6dNx:dGFgsu0k6VV0VFsN6dNx
• TLSH: T1E6309EF3105BFC4C698B5F43AAE710596446CB8D61639AB054DC772CC8B86FDBE80A21
• Submitted as: 0c8cc8_68fad3188276428db6cb9840da2f55d4.pdf
• File type: pdf · Size: 38114 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=the+queen%2527s+code+pdf, https://cdn.shopify.com/s/files/1/0431/9812/0094/files/mirozadagozazanol.pdf, https://cdn.shopify.com/s/files/1/0430/7910/6724/files/21051212137.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=the+queen%2527s+code+pdf
• https://cdn.shopify.com/s/files/1/0431/9812/0094/files/mirozadagozazanol.pdf
• https://cdn.shopify.com/s/files/1/0430/7910/6724/files/21051212137.pdf
• https://cdn.shopify.com/s/files/1/0428/1604/5222/files/antioxidant_enzymes.pdf
• https://cdn.shopify.com/s/files/1/0428/9835/8432/files/fatexuxutul.pdf
• https://cdn.shopify.com/s/files/1/0431/5214/6586/files/posanizajutiridexuziwoli.pdf
• https://d7cfa7f8-acb2-4ace-b4ee-83670160a39c.filesusr.com/ugd/f4de5e_55b33517a576461ebcea1231e62207ae.pdf?index=true
• https://cdn.shopify.com/s/files/1/0464/7183/9896/files/2723982469.pdf
• https://cdn.shopify.com/s/files/1/0461/9717/8526/files/download_lancaster_boarding_house.pdf
• https://6e396a2d-39b6-4260-9061-ee3950ee25a5.filesusr.com/ugd/3eb4bd_6acd5f8848c6493a85c9a0e9b354d656.pdf?index=true
• https://aa0f88ef-c29a-48c1-a49c-8acc85419b0b.filesusr.com/ugd/7e0eb0_0b31d34404d54934b2d7cbefc0440519.pdf?index=true
• https://d60edd81-19e4-4b8c-a937-106ef8c193a6.filesusr.com/ugd/aec2ea_3b35f584f83e4d79855bd85129f1a074.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• cdn.shopify.com
• d7cfa7f8-acb2-4ace-b4ee-83670160a39c.filesusr.com
• 6e396a2d-39b6-4260-9061-ee3950ee25a5.filesusr.com
• aa0f88ef-c29a-48c1-a49c-8acc85419b0b.filesusr.com
• d60edd81-19e4-4b8c-a937-106ef8c193a6.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report