MALICIOUS — e948c1_8a1ef10dc0dc42d7993dc7638095ac4c.pdf

MALICIOUS — e948c1_8a1ef10dc0dc42d7993dc7638095ac4c.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 89df17be481df8e2b13886b4f0693c15f147b62e7cffbd81c394726e82a60ac1
• SHA-1: 5a7d2fd42daed25b91022118de1368a36d22514c
• MD5: e2efcca3111c3cfb7d57ca6907f40759
• ssdeep: 768:dgGzpD9RO+89RmihQTVRWHyYd/aPQss2MBjjUpMtUEdoyxKBWkU:eGFxo1G/wy2aJ54jUpMSEC/BWkU
• TLSH: T17A319EF36093ED8C7A5B9B5B9FE6105D608AD78DA023967059DC3B2CC4786EC6F10920
• Submitted as: e948c1_8a1ef10dc0dc42d7993dc7638095ac4c.pdf
• File type: pdf · Size: 42943 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.PDF.Agent.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.PDF.Agent.gen (rule HEUR:Trojan.PDF.Agent.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=acts+of+faith+erich+segal+pdf, https://2a05e9e6-07fd-4ea1-9c33-bc4c83bfc150.filesusr.com/ugd/3225da_3bd8b32e1cf346e1be09dba7ea37af60.pdf?index=true, https://5e0d2410-5ebf-4d81-b4fd-e56b80c1293b.filesusr.com/ugd/8bf3fc_6f9ece3f8702420abb77b044a3c2a658.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=acts+of+faith+erich+segal+pdf
• https://2a05e9e6-07fd-4ea1-9c33-bc4c83bfc150.filesusr.com/ugd/3225da_3bd8b32e1cf346e1be09dba7ea37af60.pdf?index=true
• https://5e0d2410-5ebf-4d81-b4fd-e56b80c1293b.filesusr.com/ugd/8bf3fc_6f9ece3f8702420abb77b044a3c2a658.pdf?index=true
• https://901bf562-0d70-47bd-b852-6159ddcea5b6.filesusr.com/ugd/f1780b_b0e92698d6d745f6afd19e671b2873e3.pdf?index=true
• https://cdn.shopify.com/s/files/1/0430/3087/2215/files/42069608842.pdf
• https://cdn.shopify.com/s/files/1/0430/6714/6397/files/52032741036.pdf
• https://cdn.shopify.com/s/files/1/0433/2702/9400/files/30160691621.pdf
• https://cdn.shopify.com/s/files/1/0439/3969/2699/files/lifirifinuzeremiwupopu.pdf
• https://cdn.shopify.com/s/files/1/0435/9503/8877/files/btwin_triban_100_size_guide.pdf
• https://9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com/ugd/3ed902_b9fcd049bd5e4a4fa6a1357f49380d31.pdf?index=true
• https://819ddf08-736a-4c29-91a4-c96ee93a36fa.filesusr.com/ugd/3be48b_9b5d8c03688f4ca0914617c5bb8a616f.pdf?index=true
• https://a815f465-a0a7-45e7-a8a6-e05855a0f7cc.filesusr.com/ugd/035627_d8a8d800ea81427787a30b451829c2a1.pdf?index=true
• https://30ebd2f8-e7dd-45f8-add3-8fb0aee33585.filesusr.com/ugd/dcf9ad_3eec4acac1a44e3f9e76f61002d83e6e.pdf?index=true
• https://a59ae342-221d-429c-8d83-b9b82318dc2d.filesusr.com/ugd/5bb01c_795b1e1f6d6648c18f7eeee5c0caf651.pdf?index=true
• https://23c6e5a5-d0da-4185-b800-a59825db5807.filesusr.com/ugd/565485_2daa4fe856104bf0b50fad835ebfcf5c.pdf?index=true
• https://67e22141-a2e6-4e1d-941e-2d50546dd7e8.filesusr.com/ugd/2994dd_57a938184e554b1f8e659ddc9812d5b4.pdf?index=true
• https://31938a77-109f-49ce-b8ce-0ac01bf62ef3.filesusr.com/ugd/8e6e76_4d1e1ed227ee47a5ad05d4bd8e573d44.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• 2a05e9e6-07fd-4ea1-9c33-bc4c83bfc150.filesusr.com
• 5e0d2410-5ebf-4d81-b4fd-e56b80c1293b.filesusr.com
• 901bf562-0d70-47bd-b852-6159ddcea5b6.filesusr.com
• cdn.shopify.com
• 9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com
• 819ddf08-736a-4c29-91a4-c96ee93a36fa.filesusr.com
• a815f465-a0a7-45e7-a8a6-e05855a0f7cc.filesusr.com
• 30ebd2f8-e7dd-45f8-add3-8fb0aee33585.filesusr.com
• a59ae342-221d-429c-8d83-b9b82318dc2d.filesusr.com
• 23c6e5a5-d0da-4185-b800-a59825db5807.filesusr.com
• 67e22141-a2e6-4e1d-941e-2d50546dd7e8.filesusr.com
• 31938a77-109f-49ce-b8ce-0ac01bf62ef3.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report