MALICIOUS — 7a13df_26847f0b142e442cadb08df712deacb0.pdf

MALICIOUS — 7a13df_26847f0b142e442cadb08df712deacb0.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: a02dd9d04ea3bb6663ce611dfd937b4d2258a74c277494e3c496522dc1ca8f89
• SHA-1: b45bf6eddce8480f5beaf8a8755acade43f2a073
• MD5: 90728fff1717bf2aeb0f3404e20a6c46
• ssdeep: 768:bgGzpDAYaKuLzDWK0C4KvnKXS0lOqI1bSNm9JNEAxU5RpiPhf0O6AGSOS9755:kGFU5tvylOl1SsnpxU8PRFHGS535
• TLSH: T19A34D0F36267ECCC6987EB436DA710A8709AE68C2522A66420DC376DC47C7FC9E50910
• Submitted as: 7a13df_26847f0b142e442cadb08df712deacb0.pdf
• File type: pdf · Size: 52791 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=aa+4th+step+worksheet+examples, https://414a654d-c4cc-4cf1-b457-ed52f9042c43.filesusr.com/ugd/5b5da7_ce132913a64c4f3ab22e95c47cfa942d.pdf?index=true, https://4e960e2b-1822-4e7d-a000-4132e988c234.filesusr.com/ugd/9e41f0_10512cf84c0843ffb43905adadfcc39b.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=aa+4th+step+worksheet+examples
• https://414a654d-c4cc-4cf1-b457-ed52f9042c43.filesusr.com/ugd/5b5da7_ce132913a64c4f3ab22e95c47cfa942d.pdf?index=true
• https://4e960e2b-1822-4e7d-a000-4132e988c234.filesusr.com/ugd/9e41f0_10512cf84c0843ffb43905adadfcc39b.pdf?index=true
• https://149a6a10-6a35-4e4b-9f07-7772993b8cb1.filesusr.com/ugd/e481ce_41e574b3564b40eca271a107bdfb73d0.pdf?index=true
• https://4715a824-093c-4b79-ab59-84682a104e86.filesusr.com/ugd/76dd3d_b3e1a5ea47ea41f88588e25df1549d96.pdf?index=true
• https://cdn.shopify.com/s/files/1/0431/9507/2672/files/runescape_invention_guide_2018.pdf
• https://cdn.shopify.com/s/files/1/0429/6127/2995/files/pandora_radio_apk_download.pdf
• https://cdn.shopify.com/s/files/1/0432/4337/2699/files/27474873346.pdf
• https://cdn.shopify.com/s/files/1/0439/9595/5358/files/solamivuzejazikupubofak.pdf
• https://cdn.shopify.com/s/files/1/0435/7813/0593/files/17680039724.pdf
• https://cdn.shopify.com/s/files/1/0457/7545/4374/files/nh_t_icloud_v_iphone.pdf
• https://cdn.shopify.com/s/files/1/0438/4158/5314/files/nozojukosutomejomudumujof.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• 414a654d-c4cc-4cf1-b457-ed52f9042c43.filesusr.com
• 4e960e2b-1822-4e7d-a000-4132e988c234.filesusr.com
• 149a6a10-6a35-4e4b-9f07-7772993b8cb1.filesusr.com
• 4715a824-093c-4b79-ab59-84682a104e86.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report