MALICIOUS — 7be1cd_931118c0320c471c81ce65c8f018f8e9.pdf

MALICIOUS — 7be1cd_931118c0320c471c81ce65c8f018f8e9.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 54 detection engines flagged it.

Identification

• SHA-256: a8bd628a6090d31555ec92ddb3679e8916adaff55a29a28565cfa34654568a8a
• SHA-1: 31ed9de3f8c69149798beee84572f428d309dc23
• MD5: c93c9c87662a2f4c088ef4f45d2c8d6a
• ssdeep: 768:QgGzpDUMty84CqpYb/2GjLyBV4mquoXYkwSFgbt:9GFQlpkL2V4mqpXYkxFgbt
• TLSH: T181309EF75497DD8C768BAB03ADEB20941149C78D3233DB704989B76CC87867DAE40A20
• Submitted as: 7be1cd_931118c0320c471c81ce65c8f018f8e9.pdf
• File type: pdf · Size: 38003 bytes
• Verdict: malicious (78/100)

Detections (2 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=chicken+wing+lab+analysis+answers, https://8cf9f28e-b1c2-47d0-86c8-09043c81b9eb.filesusr.com/ugd/359e64_3de3f0c13035479da6faa3c442959f5f.pdf?index=true, https://05d9e9bd-849c-4b34-88d7-c86bdd26ece3.filesusr.com/ugd/e948c1_4ea34beae228496386706beb74273769.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=chicken+wing+lab+analysis+answers
• https://8cf9f28e-b1c2-47d0-86c8-09043c81b9eb.filesusr.com/ugd/359e64_3de3f0c13035479da6faa3c442959f5f.pdf?index=true
• https://05d9e9bd-849c-4b34-88d7-c86bdd26ece3.filesusr.com/ugd/e948c1_4ea34beae228496386706beb74273769.pdf?index=true
• https://f6c366fc-f807-11ea-a328-fc4dd43d38a6.filesusr.com/ugd/d775a9_904bc3f8fc494568b564d372cb15ead6.pdf?index=true
• https://87abbf3c-220e-4f82-813a-c3ac0df448fb.filesusr.com/ugd/f91cf1_a2e1902e21ac4be88024b48c92a35c0e.pdf?index=true
• https://e9729b69-2557-4be3-86c9-a3077739f920.filesusr.com/ugd/69695d_f27787e89b3847d8875acf13bf1fbb31.pdf?index=true
• https://94aff95d-55d3-446c-b0c6-7efdb45c0e13.filesusr.com/ugd/bf650e_ccd98a6a714244e684ff5b7d9831d710.pdf?index=true
• https://61c1fe8e-984a-4a87-b6d2-d28da0e012d1.filesusr.com/ugd/33ab24_a6b09c148c2a4f46bfb89e784b9e99ea.pdf?index=true
• https://c1bb14a5-3e91-42a5-85e6-08118855fe83.filesusr.com/ugd/eb6612_a04998346ea04b899158330447b99a32.pdf?index=true
• https://04f581e7-da1f-4b43-b352-452121160611.filesusr.com/ugd/0b46e6_f6585cd5c920478d995134440207e5cf.pdf?index=true
• https://cdn.shopify.com/s/files/1/0428/9835/8432/files/wefudebavisizaku.pdf
• https://cdn.shopify.com/s/files/1/0428/8200/7199/files/82061466850.pdf
• https://cdn.shopify.com/s/files/1/0440/8344/5925/files/crimes_of_the_heart_beth_henley.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• 8cf9f28e-b1c2-47d0-86c8-09043c81b9eb.filesusr.com
• 05d9e9bd-849c-4b34-88d7-c86bdd26ece3.filesusr.com
• f6c366fc-f807-11ea-a328-fc4dd43d38a6.filesusr.com
• 87abbf3c-220e-4f82-813a-c3ac0df448fb.filesusr.com
• e9729b69-2557-4be3-86c9-a3077739f920.filesusr.com
• 94aff95d-55d3-446c-b0c6-7efdb45c0e13.filesusr.com
• 61c1fe8e-984a-4a87-b6d2-d28da0e012d1.filesusr.com
• c1bb14a5-3e91-42a5-85e6-08118855fe83.filesusr.com
• 04f581e7-da1f-4b43-b352-452121160611.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report