MALICIOUS — d7d6cd_40567d8cb3bd41de8742ff6ac0697796.pdf
MALICIOUS — d7d6cd_40567d8cb3bd41de8742ff6ac0697796.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
91f5069b2dbcc1efb9e236d510173b990999cfb5239ef6a09dd4d510f739a5fb - SHA-1:
9fe100d3026d8e33cbb3a94cc248ca8c6b5a1f35 - MD5:
fa85bae8a3a6cd72196248372ab9142a - ssdeep:
768:vgGzpDMJQaNuy9COiCw81etO0XQya7JgIN:YGFQH4Opp1etOVfgIN - TLSH:
T10830ADF35097DD8C398B6F07AAEB00496146D68D6023AA7014D97A7CC47CBFCAF50961 - Submitted as: d7d6cd_40567d8cb3bd41de8742ff6ac0697796.pdf
- File type: pdf · Size: 36113 bytes
- Verdict: malicious (88/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
Why this verdict
The malicious score of 88/100 is the fusion of 6 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule
UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ttraff.com/wix?keyword=aic+30+exam+study+guide, https://cdn.shopify.com/s/files/1/0440/3717/7494/files/tukanupizogedezasituk.pdf, https://cdn.shopify.com/s/files/1/0431/2429/3796/files/xopidavasoxowisisud.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.com/wix?keyword=aic+30+exam+study+guide
- https://cdn.shopify.com/s/files/1/0440/3717/7494/files/tukanupizogedezasituk.pdf
- https://cdn.shopify.com/s/files/1/0431/2429/3796/files/xopidavasoxowisisud.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/mijafovaginidobu.pdf
- https://d1c266e8-0246-4a2a-8e9d-8eb00c09608c.filesusr.com/ugd/d7d6cd_5fb4a344e6e34f3ab2282f2aa5aae966.pdf?index=true
- https://7bc8c8c7-fc6d-4a78-93a8-db1ce07a8f4f.filesusr.com/ugd/296484_16a1842be7164f55a50a18c6c3528d08.pdf?index=true
- https://e1b5a097-25e1-4e59-9105-6e7f67bea951.filesusr.com/ugd/de60da_6ebd104618764dafa5110fd66b42bcce.pdf?index=true
- https://304dcf3a-aff3-465a-ab9e-6b9b052446f9.filesusr.com/ugd/3f80ec_82abba1027a94b4da89d826c05fdaf82.pdf?index=true
- https://2a0a04d1-364b-4c19-9a2a-b13c13773aec.filesusr.com/ugd/26481d_0589e5ecf8514ae1a85d8ac2956fd207.pdf?index=true
- https://c921874a-ffd3-4d96-a4d5-6b33ac7a1422.filesusr.com/ugd/8ce377_2e7c189e371942d09bef12a27aceac22.pdf?index=true
- https://bc738bd6-3113-4209-9415-18aee12742d7.filesusr.com/ugd/f08e01_db585c01736e40baa6f4a7bbc6702bf4.pdf?index=true
- https://546ed2a1-e0e8-4c92-aca8-6689911f9f88.filesusr.com/ugd/440e29_47bcfaefc64c4206b59962c66f711caa.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ttraff.com
- cdn.shopify.com
- d1c266e8-0246-4a2a-8e9d-8eb00c09608c.filesusr.com
- 7bc8c8c7-fc6d-4a78-93a8-db1ce07a8f4f.filesusr.com
- e1b5a097-25e1-4e59-9105-6e7f67bea951.filesusr.com
- 304dcf3a-aff3-465a-ab9e-6b9b052446f9.filesusr.com
- 2a0a04d1-364b-4c19-9a2a-b13c13773aec.filesusr.com
- c921874a-ffd3-4d96-a4d5-6b33ac7a1422.filesusr.com
- bc738bd6-3113-4209-9415-18aee12742d7.filesusr.com
- 546ed2a1-e0e8-4c92-aca8-6689911f9f88.filesusr.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report