MALICIOUS — 80fd5d_557dc224fa564ee595a3329e1d3b91cb.pdf

MALICIOUS — 80fd5d_557dc224fa564ee595a3329e1d3b91cb.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: a88de8057451dd03627091b311edc5f04cb7f5471a7e20f7576f76f9bea16188
• SHA-1: 00b414eb523ae0f61afc6319dcde0c3f48363604
• MD5: 70c7638bee12ac3754c4c811699fc739
• ssdeep: 3072:oFEvMoETK9md7ojEqpHaA0xOuMviUP6NLbblLv3/nnYTCMk7RyjS6L:guMoETKY+Eq1uOueFyhbNvPnYTCM2OS4
• TLSH: T10A3E01F3396BEF483D9A5B036DF251184894A988617B9794408E6B3CD47CBFDAC10E21
• Submitted as: 80fd5d_557dc224fa564ee595a3329e1d3b91cb.pdf
• File type: pdf · Size: 147092 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=fat+joe+net+worth+2017, https://99ad7475-28da-4210-b94d-817921c27dc9.filesusr.com/ugd/f35da0_94da14bf11024c0db606d18ff87e2c13.pdf?index=true, https://470a6d65-fd7c-4cc9-9d3c-537070731f2e.filesusr.com/ugd/4329d7_8d0259377b4a4ecd97ad651f8d9ef399.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=fat+joe+net+worth+2017
• https://99ad7475-28da-4210-b94d-817921c27dc9.filesusr.com/ugd/f35da0_94da14bf11024c0db606d18ff87e2c13.pdf?index=true
• https://470a6d65-fd7c-4cc9-9d3c-537070731f2e.filesusr.com/ugd/4329d7_8d0259377b4a4ecd97ad651f8d9ef399.pdf?index=true
• https://541b75d8-ea5c-4a94-a67e-3116bff98c2a.filesusr.com/ugd/9e14ca_7927ac7a1a0f42a8a83eac3ee9acce31.pdf?index=true
• https://a1e9d34c-91a0-48b7-86d2-fe8361486a30.filesusr.com/ugd/43d598_efbbf3244b5343a59829bbf28d8a49f8.pdf?index=true
• https://c91788fd-986e-416d-94af-30dbe43a78fc.filesusr.com/ugd/3225da_d88e9d630ca949f4bf04008636537933.pdf?index=true
• https://d15d547a-2908-4e3a-8705-aaea812289d6.filesusr.com/ugd/49f5ef_efb8c2b90bad4f46a06755a56031d2bc.pdf?index=true
• https://25139b70-d51c-4ed8-accb-96d8f7420378.filesusr.com/ugd/035627_de756fd1a33e48cd82c7515cbf32dd2b.pdf?index=true
• https://929ea361-af4f-45d4-aca0-6edee54350da.filesusr.com/ugd/b42fd6_3b9775443f8343c8960ce76f97357b67.pdf?index=true
• https://ce5c0e8b-4502-4a67-b6bb-38a81a9697c7.filesusr.com/ugd/5ea691_7fcb667f0c7646b58e3c9d9d893d4b4f.pdf?index=true
• https://d4cfd8db-457e-4917-b4b0-99950df29024.filesusr.com/ugd/595093_a67c2f042cca4639bcb2d08e11dde838.pdf?index=true
• https://a2c6641e-11ce-4361-93e4-ddeaaa7bea20.filesusr.com/ugd/81d6a4_de5d508cebea4111b9b40363ea7cdf2c.pdf?index=true
• https://3b93a53f-7ac2-48dc-b474-317baee0c206.filesusr.com/ugd/33a2e4_8ea665e717d443f8b54d6eb02f584944.pdf?index=true
• https://e893c09e-7f63-42d0-8389-5cec3e2036b3.filesusr.com/ugd/0a0016_b85062a65d884fe1b6ae057d1e6ae93b.pdf?index=true
• https://aff49780-6a56-4cde-8bab-e236314563aa.filesusr.com/ugd/8da65f_b78c9e69952f44bdbc760350704636e2.pdf?index=true
• https://33435d8e-f652-45c5-a5c5-2f76bc813f3a.filesusr.com/ugd/d7d6cd_902d15219edf4c68843da9146dbb91b6.pdf?index=true
• https://ccb5a1c1-d4f3-4b4e-b1b9-e6205b3819f7.filesusr.com/ugd/625844_5b4576f0b894496a8e5438d2dee0a6bb.pdf?index=true
• https://59c79bcd-91bc-4521-8b3f-b9c0e405d698.filesusr.com/ugd/70e7d4_ac5e1f91eb1642f7b7d70ffba2166817.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• 99ad7475-28da-4210-b94d-817921c27dc9.filesusr.com
• 470a6d65-fd7c-4cc9-9d3c-537070731f2e.filesusr.com
• 541b75d8-ea5c-4a94-a67e-3116bff98c2a.filesusr.com
• a1e9d34c-91a0-48b7-86d2-fe8361486a30.filesusr.com
• c91788fd-986e-416d-94af-30dbe43a78fc.filesusr.com
• d15d547a-2908-4e3a-8705-aaea812289d6.filesusr.com
• 25139b70-d51c-4ed8-accb-96d8f7420378.filesusr.com
• 929ea361-af4f-45d4-aca0-6edee54350da.filesusr.com
• ce5c0e8b-4502-4a67-b6bb-38a81a9697c7.filesusr.com
• d4cfd8db-457e-4917-b4b0-99950df29024.filesusr.com
• a2c6641e-11ce-4361-93e4-ddeaaa7bea20.filesusr.com
• 3b93a53f-7ac2-48dc-b474-317baee0c206.filesusr.com
• e893c09e-7f63-42d0-8389-5cec3e2036b3.filesusr.com
• aff49780-6a56-4cde-8bab-e236314563aa.filesusr.com
• 33435d8e-f652-45c5-a5c5-2f76bc813f3a.filesusr.com
• ccb5a1c1-d4f3-4b4e-b1b9-e6205b3819f7.filesusr.com
• 59c79bcd-91bc-4521-8b3f-b9c0e405d698.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report