MALICIOUS — e3325f_73e0aec2373d4e669b7b0832bda0e149.pdf

MALICIOUS — e3325f_73e0aec2373d4e669b7b0832bda0e149.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 8b75d4827afb4be12b286365165520352bd415a15d4ca5bf7b4a1be12bf359df
• SHA-1: c3a18255bc6d0fbb22fdce2d85b586d6afb982e0
• MD5: 06711ebb48a18f0da64127a8cdaa4266
• ssdeep: 768:kgGzpDS/H3TWYM6/o8kALWlZovrT1njIdzpDJaB8NOqK8ptGvoK0XGsR:RGFm7u1HliDgzyyzvte0XGsR
• TLSH: T19D329DF35453FD8C2A869B13ADB6129A5649C789703AA77008DD7B6CD8BC6FCAF00510
• Submitted as: e3325f_73e0aec2373d4e669b7b0832bda0e149.pdf
• File type: pdf · Size: 46562 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=least+common+spanish+words, https://20a129b2-8dfd-4c80-9e9a-17da4877edda.filesusr.com/ugd/3a38e0_83a4e2d5583d4ae78bb63a7b47375bf7.pdf?index=true, https://178351b1-e344-4555-b45d-5f3c55547557.filesusr.com/ugd/26481d_87562ebc44014e4dae5e8603a58b24c5.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=least+common+spanish+words
• https://20a129b2-8dfd-4c80-9e9a-17da4877edda.filesusr.com/ugd/3a38e0_83a4e2d5583d4ae78bb63a7b47375bf7.pdf?index=true
• https://178351b1-e344-4555-b45d-5f3c55547557.filesusr.com/ugd/26481d_87562ebc44014e4dae5e8603a58b24c5.pdf?index=true
• https://062ce586-77a1-4667-afb9-fbc788d17e7a.filesusr.com/ugd/3225da_9ccf26f7f66c4ff18146010232f8232e.pdf?index=true
• https://cdn.shopify.com/s/files/1/0431/1223/5159/files/32277994883.pdf
• https://cdn.shopify.com/s/files/1/0441/2784/6552/files/levigojif.pdf
• https://cdn.shopify.com/s/files/1/0428/6929/3223/files/zijubatodudewugedixi.pdf
• https://cdn.shopify.com/s/files/1/0428/9373/8143/files/ximipel.pdf
• https://cdn.shopify.com/s/files/1/0440/9648/7576/files/midemalevi.pdf
• https://cdn.shopify.com/s/files/1/0431/2167/2356/files/dinitokabuge.pdf
• https://c9b5d448-e9ad-464f-b628-84219c1d9562.filesusr.com/ugd/dcc11b_a48d90ba5fee41de8d1d9a651cfb45de.pdf?index=true
• https://fad48078-8902-48fe-a86a-479a06800898.filesusr.com/ugd/e948c1_98be04c2eb414930ae52955ddb78db3b.pdf?index=true
• https://6d0786eb-5590-4ff2-b3c3-3b6fba4261ba.filesusr.com/ugd/b7306e_87975318729546429eb3502a235dc957.pdf?index=true
• https://47ccec72-592e-4b6e-8e95-0fd21d4669a3.filesusr.com/ugd/70e7d4_16be62037b1c4b0ba19ae1dbb9cee4ee.pdf?index=true
• https://37ae1153-c7ab-4fb2-8485-8d1c4394e5a6.filesusr.com/ugd/f34323_722622f8ad954f56910e4cb7e6c792c7.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• 20a129b2-8dfd-4c80-9e9a-17da4877edda.filesusr.com
• 178351b1-e344-4555-b45d-5f3c55547557.filesusr.com
• 062ce586-77a1-4667-afb9-fbc788d17e7a.filesusr.com
• cdn.shopify.com
• c9b5d448-e9ad-464f-b628-84219c1d9562.filesusr.com
• fad48078-8902-48fe-a86a-479a06800898.filesusr.com
• 6d0786eb-5590-4ff2-b3c3-3b6fba4261ba.filesusr.com
• 47ccec72-592e-4b6e-8e95-0fd21d4669a3.filesusr.com
• 37ae1153-c7ab-4fb2-8485-8d1c4394e5a6.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report