MALICIOUS — 3f2390_cb5df91de0f5482b9d8f1ab2eed882b5.pdf

MALICIOUS — 3f2390_cb5df91de0f5482b9d8f1ab2eed882b5.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 91f4d192816c41ee55b9aee08660e7ad9599718e9a0240ce12ac47ff7a4140cd
• SHA-1: 4150c9b8e05d7922aaf7bbdb9cb6a4f9d8c982e7
• MD5: 5caf2b62a767cfd78373bdedb2fc7350
• ssdeep: 768:ogGzpD//f4nfbR9BGW/kbTzXJAZXkmFt53bQ4Lp5QYhq6X1oiLxOsrw1bwPD+:lGFbf7XKd5Ft5rQ4Lp5QYhq6FoJbwPD+
• TLSH: T1F031AEF35867EC8836C6DB0768EA110EA1CAEB882173E6741AE9375CC1781FD7D40961
• Submitted as: 3f2390_cb5df91de0f5482b9d8f1ab2eed882b5.pdf
• File type: pdf · Size: 42178 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=girlfriends+guide+to+divorce+music+season+1, https://cdn.shopify.com/s/files/1/0432/4347/1010/files/ppap_apqp_fmea.pdf, https://cdn.shopify.com/s/files/1/0428/0179/1132/files/65314696811.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=girlfriends+guide+to+divorce+music+season+1
• https://cdn.shopify.com/s/files/1/0432/4347/1010/files/ppap_apqp_fmea.pdf
• https://cdn.shopify.com/s/files/1/0428/0179/1132/files/65314696811.pdf
• https://cdn.shopify.com/s/files/1/0462/6717/0970/files/fagutovugamugegusex.pdf
• https://cdn.shopify.com/s/files/1/0438/3549/0461/files/poem_comprehension_worksheets_for_grade_2.pdf
• https://cdn.shopify.com/s/files/1/0433/0687/7080/files/doragewotupepefe.pdf
• https://4d36acb3-462c-4411-8859-ec11d71b07a6.filesusr.com/ugd/bc4951_572d26d8289e4da2bd4bddb0ff4fceda.pdf?index=true
• https://ed669bc0-2014-41ed-a421-ce0ee8d760d8.filesusr.com/ugd/debbe1_b416c384d1e24d5d87bd0987d64fc1da.pdf?index=true
• https://cb6a572d-c191-46f9-81e1-86a938113a62.filesusr.com/ugd/92ee2b_5fcb8667b1674981991cbef0fa8ecf75.pdf?index=true
• https://f59b0b9d-5d38-43bf-aefd-84966829013c.filesusr.com/ugd/9f2514_207fd364fa944bbfbf815b0e3d1d8aa7.pdf?index=true
• https://6d7e3c53-3c76-4f3d-9f5b-9f80f9b8a64f.filesusr.com/ugd/5b9a87_b2a287ce726f4e76ad9070e5a9ede30a.pdf?index=true
• https://cdn.shopify.com/s/files/1/0434/8110/4541/files/sikemasewedelekesuvir.pdf
• https://cdn.shopify.com/s/files/1/0461/8495/6057/files/31391913051.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• cdn.shopify.com
• 4d36acb3-462c-4411-8859-ec11d71b07a6.filesusr.com
• ed669bc0-2014-41ed-a421-ce0ee8d760d8.filesusr.com
• cb6a572d-c191-46f9-81e1-86a938113a62.filesusr.com
• f59b0b9d-5d38-43bf-aefd-84966829013c.filesusr.com
• 6d7e3c53-3c76-4f3d-9f5b-9f80f9b8a64f.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report