MALICIOUS — 8a9bcc_c75eb5b65daa44a089bcaf992f633e97.pdf

MALICIOUS — 8a9bcc_c75eb5b65daa44a089bcaf992f633e97.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 96be7923f28ee397c0d818c68c0fb7a70d9b3dd376e37223bae0064b9ac1c59c
• SHA-1: f46b1917d4d48b11a4984726ff624a922e258242
• MD5: ee648acaf43bf8363cdc8380c7948a88
• ssdeep: 768:pgGzpDQfpbQZyjWpQ+YmmJZr2p5DqN7exnWKtgh2Sk5SqNJg:KGFs/M7FW33k5SqNJg
• TLSH: T1A62F8EF35497EC8C76CA6B476EAB105CA04ADB8D6036A66048DC7B6CD47C2FC6F40960
• Submitted as: 8a9bcc_c75eb5b65daa44a089bcaf992f633e97.pdf
• File type: pdf · Size: 35312 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=the+fox+and+the+hound+book+ebay, https://cdn.shopify.com/s/files/1/0434/4823/8241/files/9807145262.pdf, https://cdn.shopify.com/s/files/1/0440/2266/1278/files/widewevijogenipodivi.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=the+fox+and+the+hound+book+ebay
• https://cdn.shopify.com/s/files/1/0434/4823/8241/files/9807145262.pdf
• https://cdn.shopify.com/s/files/1/0440/2266/1278/files/widewevijogenipodivi.pdf
• https://cdn.shopify.com/s/files/1/0433/8037/5704/files/duxosuz.pdf
• https://cdn.shopify.com/s/files/1/0457/0352/8604/files/putiju.pdf
• https://cdn.shopify.com/s/files/1/0431/7478/9281/files/62058300920.pdf
• https://cdn.shopify.com/s/files/1/0429/7955/7529/files/genofutofasobipi.pdf
• https://cdn.shopify.com/s/files/1/0435/1780/4708/files/xonitofavirexexudupoj.pdf
• https://cdn.shopify.com/s/files/1/0428/2882/4742/files/dujovos.pdf
• https://cdn.shopify.com/s/files/1/0433/5910/9279/files/52160188649.pdf
• https://cdn.shopify.com/s/files/1/0434/4964/7261/files/risen_lyrics.pdf
• https://cdn.shopify.com/s/files/1/0432/8266/1526/files/xobovopososipixap.pdf
• https://cdn.shopify.com/s/files/1/0431/6381/1999/files/b._pharmacy_syllabus_pci.pdf
• https://5a228f77-6167-4858-950a-453e1ca646d2.filesusr.com/ugd/760101_bb3918e33c724a8aa2e2526085852c2e.pdf?index=true
• https://97c630d3-5cd0-452e-a7f1-a9ce30dde161.filesusr.com/ugd/1e52da_079f9f32ecd1419da00f4ce8fd7834bf.pdf?index=true
• https://292e3e6b-e343-4fc6-bcd7-102dc1ba6f56.filesusr.com/ugd/c638b7_ca10b59073f74be99d908b3e31435cad.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• cdn.shopify.com
• 5a228f77-6167-4858-950a-453e1ca646d2.filesusr.com
• 97c630d3-5cd0-452e-a7f1-a9ce30dde161.filesusr.com
• 292e3e6b-e343-4fc6-bcd7-102dc1ba6f56.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report