MALICIOUS — 89064d_00c568b66dd34adb94a6d30d27c3578f.pdf

MALICIOUS — 89064d_00c568b66dd34adb94a6d30d27c3578f.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 900b3139cb029d3b4659439fbf8c78f364521eb6ecdfbb34b8ec46234d680a9a
• SHA-1: 913f0eb18c173ba42ce7683e2718d894f11e61a3
• MD5: 4d71ff256f9d8df0f4726d767c98d721
• ssdeep: 768:OgGzpDXRcFjeWOxt9NevCIxN9RrBR49s0lSmS9LesFO9bRNL:rGFb3rNe3xJrBR0s0lSmS1esFYbRNL
• TLSH: T1CF32AEF3559BED4C768B5B03ACA601122486C78DB132D76159DC3A3CC4BC6ADBF10661
• Submitted as: 89064d_00c568b66dd34adb94a6d30d27c3578f.pdf
• File type: pdf · Size: 44322 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=mudbound+book+pdf, https://cdn.shopify.com/s/files/1/0441/1247/8360/files/94877560884.pdf, https://cdn.shopify.com/s/files/1/0432/8616/7702/files/historia_del_cementerio_presbtero_maestro.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=mudbound+book+pdf
• https://cdn.shopify.com/s/files/1/0441/1247/8360/files/94877560884.pdf
• https://cdn.shopify.com/s/files/1/0432/8616/7702/files/historia_del_cementerio_presbtero_maestro.pdf
• https://cdn.shopify.com/s/files/1/0431/8950/2110/files/21288778169.pdf
• https://cdn.shopify.com/s/files/1/0461/9436/0483/files/71003848154.pdf
• https://cdn.shopify.com/s/files/1/0438/6825/8469/files/azure_information_protection_mac_os_x.pdf
• https://cf2beb9b-2d83-4e1a-bc33-a5e65a185e3f.filesusr.com/ugd/154db6_e1b81d3291bd46a18b7935363dee4256.pdf?index=true
• https://9f38e598-0eb6-4ab4-b425-6297cbffd2b3.filesusr.com/ugd/33ab24_acceefce51404c91b79c8c3a8bb9fb81.pdf?index=true
• https://5dd11264-e94b-46c0-ad94-8984b9cf59d4.filesusr.com/ugd/18f527_c1b8404c182049da95fa36559e552994.pdf?index=true
• https://f915a33e-f807-11ea-a328-fc4dd43d38a6.filesusr.com/ugd/9ef0c3_4541a83cf6a3405ca5ea10b951df6fe5.pdf?index=true
• https://c288df73-8656-4f24-a0a7-1c9c69ac61be.filesusr.com/ugd/2994dd_477fd5f9c2e343eeb1cffc35ac4378f9.pdf?index=true
• https://08e9a0cb-98d7-43e6-afca-dac049ecaf0a.filesusr.com/ugd/a91264_23985fc27e814862ae7ded2aea6171b2.pdf?index=true
• https://14732304-f808-11ea-a328-fc4dd43d38a6.filesusr.com/ugd/9117e0_0735683d6aba43a88d7b673d6421f259.pdf?index=true
• https://eaf140de-2736-4f6c-a4de-289bc98c1b9c.filesusr.com/ugd/dcf311_384e75caa8e04c8abec9b99f10e86296.pdf?index=true
• https://3d8576e5-7465-4a04-8012-2dd00f5a615a.filesusr.com/ugd/682d1c_5622abd2fec84cda8a51c9e40f3aa918.pdf?index=true
• https://9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com/ugd/3ed902_b9fcd049bd5e4a4fa6a1357f49380d31.pdf?index=true
• https://19867a25-dc77-425f-97a9-ab14bda4a674.filesusr.com/ugd/9df9d6_d200703251a848a6b97a32655d8de01f.pdf?index=true
• https://f9e93eb7-f703-4f5b-90b9-5a452d306726.filesusr.com/ugd/3be48b_acf5469df6bd47a9b34b91aa1080a1d8.pdf?index=true
• https://00819d8f-8d29-41fa-81e6-d452beb49495.filesusr.com/ugd/b463f2_1953755e6bce45b8a9a4ed1780a3ab78.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• cdn.shopify.com
• cf2beb9b-2d83-4e1a-bc33-a5e65a185e3f.filesusr.com
• 9f38e598-0eb6-4ab4-b425-6297cbffd2b3.filesusr.com
• 5dd11264-e94b-46c0-ad94-8984b9cf59d4.filesusr.com
• f915a33e-f807-11ea-a328-fc4dd43d38a6.filesusr.com
• c288df73-8656-4f24-a0a7-1c9c69ac61be.filesusr.com
• 08e9a0cb-98d7-43e6-afca-dac049ecaf0a.filesusr.com
• 14732304-f808-11ea-a328-fc4dd43d38a6.filesusr.com
• eaf140de-2736-4f6c-a4de-289bc98c1b9c.filesusr.com
• 3d8576e5-7465-4a04-8012-2dd00f5a615a.filesusr.com
• 9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com
• 19867a25-dc77-425f-97a9-ab14bda4a674.filesusr.com
• f9e93eb7-f703-4f5b-90b9-5a452d306726.filesusr.com
• 00819d8f-8d29-41fa-81e6-d452beb49495.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report