MALICIOUS — 96564c_494b5e8e764d4a30bf42812d943dc235.pdf

MALICIOUS — 96564c_494b5e8e764d4a30bf42812d943dc235.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 9205faed53d42e3da711f9fbd0110bff49588431215b63cf056522c9cf51ba35
• SHA-1: 2e46f07cb1a65196ac9920a56c882bb5207b8c02
• MD5: f67e063e325038dfd904d719c48cd7ac
• ssdeep: 768:OgGzpDLophlgLocYeq7qaQwyGQ6S3RiCq8g8nFDp9TcaY1Z/9:rGF3oMqeQilhZooFDpxcNZ/9
• TLSH: T13734BFF34457ECCC2A8A6F079EA6296AA0C1D78D6123925416DC737CC47CAFE5B50A30
• Submitted as: 96564c_494b5e8e764d4a30bf42812d943dc235.pdf
• File type: pdf · Size: 52927 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=nmsqt+finalist+2020, https://6b1c1404-0863-4c3f-b3bd-7082b1e290d9.filesusr.com/ugd/8a9bcc_93b68a5e298b48d0acde1f3b44b849dd.pdf?index=true, https://b62f190d-c4d5-4acc-a4d3-a554b1142c38.filesusr.com/ugd/d5d855_b2dbba74657b421589f8ab5ac8b28586.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=nmsqt+finalist+2020
• https://6b1c1404-0863-4c3f-b3bd-7082b1e290d9.filesusr.com/ugd/8a9bcc_93b68a5e298b48d0acde1f3b44b849dd.pdf?index=true
• https://b62f190d-c4d5-4acc-a4d3-a554b1142c38.filesusr.com/ugd/d5d855_b2dbba74657b421589f8ab5ac8b28586.pdf?index=true
• https://57a9e4ef-34a8-4c72-8aea-f1b52fa9420d.filesusr.com/ugd/5438e3_9168b3f2e5da43fb8dbd21195ec1cfb4.pdf?index=true
• https://cdn.shopify.com/s/files/1/0463/9578/5371/files/nozatemurelitukevubar.pdf
• https://cdn.shopify.com/s/files/1/0454/7484/0742/files/80153727393.pdf
• https://cdn.shopify.com/s/files/1/0431/8593/0389/files/9869846515.pdf
• https://b605ce49-3ab7-47a2-90c2-6dba406840d5.filesusr.com/ugd/37987b_5e72e4c6f7bd4c8da8c0c6d8c72bc9bf.pdf?index=true
• https://de1932dd-c19e-498f-b082-2eb4bc7c4338.filesusr.com/ugd/c4dbd3_916bdc5d29af4b1db60f678e8e3265b2.pdf?index=true
• https://6820e32c-6ea2-4ec5-b82d-05e08fc26f5d.filesusr.com/ugd/6f9b04_2de977321e8d4a339d0bb49072c63052.pdf?index=true
• https://bd2fdb06-3ae2-450d-aed9-4f69844269bc.filesusr.com/ugd/f3cb45_49c4478e83804dedabc803ed1b97c306.pdf?index=true
• https://624f5409-d1bb-40e7-aaaa-5aa409754731.filesusr.com/ugd/38eac1_989b943c5e644eae91f178fe895714f0.pdf?index=true
• https://69244a2d-9942-4e63-a911-5f4f6422d967.filesusr.com/ugd/70e5f7_92dd2ecdd87144b4b00472f0ebe8b649.pdf?index=true
• https://d7f49e72-f7d1-4bf4-b39c-cdc358258aba.filesusr.com/ugd/ed2d23_5fe38198fc4840439d0a0e296c9ab033.pdf?index=true
• https://25f6dffb-7213-4c0c-a1fb-344d591bc2d3.filesusr.com/ugd/bfbc46_33e6281e650446ae93187974c175488c.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• 6b1c1404-0863-4c3f-b3bd-7082b1e290d9.filesusr.com
• b62f190d-c4d5-4acc-a4d3-a554b1142c38.filesusr.com
• 57a9e4ef-34a8-4c72-8aea-f1b52fa9420d.filesusr.com
• cdn.shopify.com
• b605ce49-3ab7-47a2-90c2-6dba406840d5.filesusr.com
• de1932dd-c19e-498f-b082-2eb4bc7c4338.filesusr.com
• 6820e32c-6ea2-4ec5-b82d-05e08fc26f5d.filesusr.com
• bd2fdb06-3ae2-450d-aed9-4f69844269bc.filesusr.com
• 624f5409-d1bb-40e7-aaaa-5aa409754731.filesusr.com
• 69244a2d-9942-4e63-a911-5f4f6422d967.filesusr.com
• d7f49e72-f7d1-4bf4-b39c-cdc358258aba.filesusr.com
• 25f6dffb-7213-4c0c-a1fb-344d591bc2d3.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report