MALICIOUS — 1c8c1e_bb18b670c6f84ead9c5e25cc2f8bc4b8.pdf

MALICIOUS — 1c8c1e_bb18b670c6f84ead9c5e25cc2f8bc4b8.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 9a5871a2c5a9eb2a2d4604b84a62030ec02c6b9dd215ecc7dac9f79854089716
• SHA-1: 0d6c28a0166a01e0eb3a5c3191d4e971df8959b9
• MD5: a1b0866f27ad5d5c4ba8891ac39c86ef
• ssdeep: 1536:LGF1TB5j4BPdx05FzCW8KrBdVap6eQc6cFIiIzD06T6r:qF1TB4F+zeJK5mTdFIfVu
• TLSH: T1FA37C0F35197DD9C6A87EF036EDE216A9080DA8C1122923059E9BF3CC17C7BC6E51960
• Submitted as: 1c8c1e_bb18b670c6f84ead9c5e25cc2f8bc4b8.pdf
• File type: pdf · Size: 73431 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=rhode+gear+bike+rack+instructions+pdf, https://95436cbb-6ba0-40f3-bbf7-3b5b37ff98ca.filesusr.com/ugd/0182ef_4cd773aec1234e169ae048c2c48bc827.pdf?index=true, https://ad1654b4-90dd-443f-ab69-fd65f3729815.filesusr.com/ugd/3835dd_c0c00f3757fa43e49d47eb216464b415.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=rhode+gear+bike+rack+instructions+pdf
• https://95436cbb-6ba0-40f3-bbf7-3b5b37ff98ca.filesusr.com/ugd/0182ef_4cd773aec1234e169ae048c2c48bc827.pdf?index=true
• https://ad1654b4-90dd-443f-ab69-fd65f3729815.filesusr.com/ugd/3835dd_c0c00f3757fa43e49d47eb216464b415.pdf?index=true
• https://582c9ee9-d774-4eee-9247-15f42b598df7.filesusr.com/ugd/685707_ce445fe568f443ef929251203555b1ed.pdf?index=true
• https://c4298054-a7cb-4798-ac0e-cacde2184d33.filesusr.com/ugd/bc0b97_42abee5a807d4663ac1f0f7a582fee8f.pdf?index=true
• https://7949a473-29a5-4b91-a818-5313b01aedc0.filesusr.com/ugd/4a2613_f498878873a140088c8384ca9a4cb23f.pdf?index=true
• https://cdn.shopify.com/s/files/1/0440/3170/5238/files/34154502433.pdf
• https://f4b6aa88-1b8b-4121-91b9-82911a9ce041.filesusr.com/ugd/610d21_fcbe05d54a5c4c6890b2cf6325261b20.pdf?index=true
• https://8980c9d2-0493-4edb-a8f3-2f31e7d453eb.filesusr.com/ugd/f80014_2e6f3f73b6664a9fa32c75484b2be892.pdf?index=true
• https://ba75fa4f-0021-4878-a475-63fdfa0c3fa5.filesusr.com/ugd/26481d_6846f5ce7f4841af830d15964c409b33.pdf?index=true
• https://e6afdd3b-439b-42e2-936a-ab80d9e80016.filesusr.com/ugd/1e52da_ebfa159b249b4213a11ec0d167ccc0f2.pdf?index=true
• https://8bbfc41e-1215-4ebb-af96-ca73619412f2.filesusr.com/ugd/defcb2_b632ce159401421ab5f2db8275090ec5.pdf?index=true
• https://dc99b820-f973-4c20-a9a5-5e340e392d28.filesusr.com/ugd/ab922d_b8d33502e2204e669069b4a96a357f03.pdf?index=true
• https://a29039ef-3102-4bc1-a5a5-7ff5d0246ffd.filesusr.com/ugd/911c12_85c6815649304b2aaf0caebcedc9c080.pdf?index=true
• https://884d7d92-59ee-4437-a07f-a661e2a340d9.filesusr.com/ugd/ac8c68_02f9a8db71b34858a66849894f7b514c.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• 95436cbb-6ba0-40f3-bbf7-3b5b37ff98ca.filesusr.com
• ad1654b4-90dd-443f-ab69-fd65f3729815.filesusr.com
• 582c9ee9-d774-4eee-9247-15f42b598df7.filesusr.com
• c4298054-a7cb-4798-ac0e-cacde2184d33.filesusr.com
• 7949a473-29a5-4b91-a818-5313b01aedc0.filesusr.com
• cdn.shopify.com
• f4b6aa88-1b8b-4121-91b9-82911a9ce041.filesusr.com
• 8980c9d2-0493-4edb-a8f3-2f31e7d453eb.filesusr.com
• ba75fa4f-0021-4878-a475-63fdfa0c3fa5.filesusr.com
• e6afdd3b-439b-42e2-936a-ab80d9e80016.filesusr.com
• 8bbfc41e-1215-4ebb-af96-ca73619412f2.filesusr.com
• dc99b820-f973-4c20-a9a5-5e340e392d28.filesusr.com
• a29039ef-3102-4bc1-a5a5-7ff5d0246ffd.filesusr.com
• 884d7d92-59ee-4437-a07f-a661e2a340d9.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report