MALICIOUS — 33ab24_46db40b81b0e426690cae40ecd3c3878.pdf

MALICIOUS — 33ab24_46db40b81b0e426690cae40ecd3c3878.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 54 detection engines flagged it.

Identification

• SHA-256: 8d1d4b63a5e6f7dc5319a098d2609acf4f5c28eb81a298e7ac05a9b00a5e4ec9
• SHA-1: 99b05fdc289dcd2873ea070f03db66a66509686f
• MD5: 24e4c5a63d736895c37d2dbe2feb244e
• ssdeep: 768:EgGzpDwVr8Rj6OutEi7OUqVd82sWB/pGadNFUr3ru/:xGFUVrOiXqVd7sWB4adUr3ru/
• TLSH: T1172F7EF3505BED8D7A8F6F036ADB11995049D68D7122A6A0498C7B7CC4BCABC7F10920
• Submitted as: 33ab24_46db40b81b0e426690cae40ecd3c3878.pdf
• File type: pdf · Size: 33459 bytes
• Verdict: malicious (78/100)

Detections (2 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=htc+lock+screen+apk, https://cdn.shopify.com/s/files/1/0439/0954/6136/files/segupolunif.pdf, https://cdn.shopify.com/s/files/1/0436/3275/4841/files/complexity_and_contradiction_in_architecture_robert_venturi_download.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=htc+lock+screen+apk
• https://cdn.shopify.com/s/files/1/0439/0954/6136/files/segupolunif.pdf
• https://cdn.shopify.com/s/files/1/0436/3275/4841/files/complexity_and_contradiction_in_architecture_robert_venturi_download.pdf
• https://cdn.shopify.com/s/files/1/0463/4116/1116/files/peroxido_de_benzoilo_forma_de_uso.pdf
• https://cdn.shopify.com/s/files/1/0438/8257/8088/files/soil_mechanics_lab_manual.pdf
• https://e658d3d7-cab3-4361-986f-104cdac76f22.filesusr.com/ugd/dcf311_20afaff542d540a6a48e3afbd45bcd08.pdf?index=true
• https://9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com/ugd/3ed902_b9fcd049bd5e4a4fa6a1357f49380d31.pdf?index=true
• https://bad08d10-9daa-4bc1-9a8f-7d71fca25cb1.filesusr.com/ugd/dcc11b_ecbeefca44e043b3a2c943de325dc517.pdf?index=true
• http://dumej.clinicalsupervisor.org/uploads/1/3/0/8/130813528/3155df.pdf
• http://xavajo.nathalychicas.com/uploads/1/3/0/7/130775826/b011c8549d1934.pdf
• http://files.dkbwritingawards.com/uploads/1/3/0/7/130740124/dibadepilawi_nirupopixaz_volavede.pdf
• http://files.telderberries.com/uploads/1/3/1/4/131438111/dazoxivado.pdf
• https://1e20613e-b4fd-486e-aea2-5c8d840a24db.filesusr.com/ugd/696117_bcc0926bf7db48468c5e329df03becff.pdf?index=true
• https://fb60ed15-61f0-4f66-8872-620ba323d532.filesusr.com/ugd/c57cae_5c6c4586b1e04e82be6540647288178b.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• cdn.shopify.com
• e658d3d7-cab3-4361-986f-104cdac76f22.filesusr.com
• 9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com
• bad08d10-9daa-4bc1-9a8f-7d71fca25cb1.filesusr.com
• dumej.clinicalsupervisor.org
• xavajo.nathalychicas.com
• files.dkbwritingawards.com
• files.telderberries.com
• 1e20613e-b4fd-486e-aea2-5c8d840a24db.filesusr.com
• fb60ed15-61f0-4f66-8872-620ba323d532.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report