MALICIOUS — e643da_6d4ac140ea0041529ef708cec27f0d63.pdf

MALICIOUS — e643da_6d4ac140ea0041529ef708cec27f0d63.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: a55eea406ef66a6db2f74046912181e1180090e839509aa5bc6f5a8d41642766
• SHA-1: 768e240e38119838640a9db7fc3959fef6d9c112
• MD5: cde1f1da475ebda85ed8b065951d1f48
• ssdeep: 1536:9GFxT6l181OPq7Wabyf3aHQN8t3drcwfr6c7mH:AFxIi7yfNN8tNrcwjz7S
• TLSH: T11235BFF351CBED8CAA97AB135CEA11166489D6CC6237AB1048D87B7CC0BC2BC5F14961
• Submitted as: e643da_6d4ac140ea0041529ef708cec27f0d63.pdf
• File type: pdf · Size: 60191 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=cuantos+anos+tiene+la+esposa+de+marco+antonio+solis, https://f4ef83b3-6be6-4ec8-83a4-93f10c27e79b.filesusr.com/ugd/70e7d4_d4f9d8adb62e4f269fe1a81440f61c78.pdf?index=true, https://d12b36ab-8644-4dc1-b413-a13d82a6d7bd.filesusr.com/ugd/89064d_e3b96bc8a0c444cc97cc51b57b96de49.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=cuantos+anos+tiene+la+esposa+de+marco+antonio+solis
• https://f4ef83b3-6be6-4ec8-83a4-93f10c27e79b.filesusr.com/ugd/70e7d4_d4f9d8adb62e4f269fe1a81440f61c78.pdf?index=true
• https://d12b36ab-8644-4dc1-b413-a13d82a6d7bd.filesusr.com/ugd/89064d_e3b96bc8a0c444cc97cc51b57b96de49.pdf?index=true
• https://db5b158e-8a5f-461f-b677-84e21ed28008.filesusr.com/ugd/d7d6cd_9e87fec4c244462fac6ac2f8d87343a4.pdf?index=true
• https://ad4625e8-6434-4738-bef9-95675f885def.filesusr.com/ugd/35c6e2_0c087df9fba842c0b6fcb2bac0cd73e1.pdf?index=true
• https://3e53d06d-c86f-4de8-8ae1-6d32ee2fcdf9.filesusr.com/ugd/2eedf1_b721111a94b24e9993d029b1c1191ed2.pdf?index=true
• https://031e39b9-e075-4b92-bc8c-b3573f193895.filesusr.com/ugd/c5d40f_5f6ebcae84b2460a9f132bec2a7e6151.pdf?index=true
• https://25f3f624-4ab6-4ccd-b2c8-3229da0d83b1.filesusr.com/ugd/3eb4bd_a4d85fe8d1294d4486303ab9abad06f6.pdf?index=true
• https://efcc13d5-fa24-4ef5-87e6-8174401c9ec9.filesusr.com/ugd/b1b3ad_932c6200b7c242249136abb5a0685e9d.pdf?index=true
• https://e73d3cea-d046-4313-9b1a-04b6cc479dbe.filesusr.com/ugd/3bcfef_d9b9bf2dd0a74540a4d764e98d33e265.pdf?index=true
• https://6e817068-b67c-4055-90d7-792ca2554871.filesusr.com/ugd/b1b3ad_e18172ec7615428a8902df5b1caedf8c.pdf?index=true
• https://494cd54b-9bf6-445e-8b0f-2cf8c1a9d7ff.filesusr.com/ugd/cc3ca9_7da3c8e76e084d3c84ef8ccb4c166cee.pdf?index=true
• https://ea251745-e9fc-4daf-8838-3fbc7e94d97e.filesusr.com/ugd/384ea4_0985c6ece0824e0189ac8a8578d409c8.pdf?index=true
• https://ed9db4e3-4766-4277-a081-0224999d9743.filesusr.com/ugd/18ee90_e63bd8e9ba1a4184bd76c0b962f74ce7.pdf?index=true
• https://cdn.shopify.com/s/files/1/0431/0564/8791/files/sumofazevikedegawekigaxi.pdf
• https://cdn.shopify.com/s/files/1/0432/1060/4705/files/easy_living_1937.pdf
• https://cdn.shopify.com/s/files/1/0432/1227/5870/files/19173369448.pdf
• https://cdn.shopify.com/s/files/1/0429/5104/9370/files/66263225280.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• f4ef83b3-6be6-4ec8-83a4-93f10c27e79b.filesusr.com
• d12b36ab-8644-4dc1-b413-a13d82a6d7bd.filesusr.com
• db5b158e-8a5f-461f-b677-84e21ed28008.filesusr.com
• ad4625e8-6434-4738-bef9-95675f885def.filesusr.com
• 3e53d06d-c86f-4de8-8ae1-6d32ee2fcdf9.filesusr.com
• 031e39b9-e075-4b92-bc8c-b3573f193895.filesusr.com
• 25f3f624-4ab6-4ccd-b2c8-3229da0d83b1.filesusr.com
• efcc13d5-fa24-4ef5-87e6-8174401c9ec9.filesusr.com
• e73d3cea-d046-4313-9b1a-04b6cc479dbe.filesusr.com
• 6e817068-b67c-4055-90d7-792ca2554871.filesusr.com
• 494cd54b-9bf6-445e-8b0f-2cf8c1a9d7ff.filesusr.com
• ea251745-e9fc-4daf-8838-3fbc7e94d97e.filesusr.com
• ed9db4e3-4766-4277-a081-0224999d9743.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report