MALICIOUS — 370021_3d6852ce9a95415da87818a420203529.pdf

MALICIOUS — 370021_3d6852ce9a95415da87818a420203529.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: ad77e10cebfb980678d5a86da8b8964540cc4b75d59775e31343b934f13bf518
• SHA-1: bad817ccb7a75aad98456b5207147442bd2c80b5
• MD5: f2920055d6350bf3a154725632213c37
• ssdeep: 1536:RGFAWueeuzVP0YNflNLTJ7XWIHB0rT0k0/X:0FAWguznflvWWj
• TLSH: T179339DF350A7DD8C378ABF0729EB15686085D78C61239A9059D8762CC4BC7FCEE10A61
• Submitted as: 370021_3d6852ce9a95415da87818a420203529.pdf
• File type: pdf · Size: 49153 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=alan+turing+enigma+andrew+hodges+pdf, https://cdn.shopify.com/s/files/1/0435/2468/5976/files/62931500887.pdf, https://cdn.shopify.com/s/files/1/0438/3938/9856/files/ledamefuweresibiso.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=alan+turing+enigma+andrew+hodges+pdf
• https://cdn.shopify.com/s/files/1/0435/2468/5976/files/62931500887.pdf
• https://cdn.shopify.com/s/files/1/0438/3938/9856/files/ledamefuweresibiso.pdf
• https://cdn.shopify.com/s/files/1/0431/8678/2369/files/bescherelle_cole_gratuit.pdf
• https://cdn.shopify.com/s/files/1/0433/0687/7080/files/wevanedinuwisuvajolow.pdf
• https://f89c9433-75eb-4e86-90f6-61ef89f4a7e5.filesusr.com/ugd/370021_d50f821724264002ab3a7516c7df828a.pdf?index=true
• https://d4b4a664-a029-4ea2-b58d-ec0fc092c9c2.filesusr.com/ugd/296484_1559a695ea5a4fd0a774537bc924d5b9.pdf?index=true
• https://031e39b9-e075-4b92-bc8c-b3573f193895.filesusr.com/ugd/c5d40f_5f6ebcae84b2460a9f132bec2a7e6151.pdf?index=true
• https://6097fb04-7ba8-4b95-928c-a1efe2fc0efc.filesusr.com/ugd/4329d7_89f8185e2ec846908a9d526754df02f6.pdf?index=true
• https://aeacac57-82f6-48db-af0c-cd17eb07d15a.filesusr.com/ugd/3225da_acae7881031c4761a38d917cd0a42052.pdf?index=true
• https://57658277-3b66-4a4e-beb8-e4dfcc50d4d1.filesusr.com/ugd/dcc11b_f952e3a9a5534b1b9fb4d90b92ddd8fa.pdf?index=true
• https://68a1a05d-3908-406c-9709-107562a3e5fe.filesusr.com/ugd/cc3ca9_f342df20ec8b4031bf7d048cd85c0b6f.pdf?index=true
• https://ec8d66cd-493c-4cde-875a-44e26b5db311.filesusr.com/ugd/65b209_fa9f02e1022f4aa1a95b65eee92564b7.pdf?index=true
• https://d3cd654f-bff4-480e-a279-ddaca14ce48a.filesusr.com/ugd/33ab24_21f9663189ba4e65ad5708ed1abb8b9d.pdf?index=true
• https://6855af34-7ffd-4acd-8cff-47db9d210f10.filesusr.com/ugd/3225da_872e15f75b5644abbcfff8ce273ff177.pdf?index=true
• https://224ebdf5-0b00-4414-a4b7-96072c4e17b6.filesusr.com/ugd/0582e0_438ec10ec8ba4d4bad0c6b93b6589f95.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• cdn.shopify.com
• f89c9433-75eb-4e86-90f6-61ef89f4a7e5.filesusr.com
• d4b4a664-a029-4ea2-b58d-ec0fc092c9c2.filesusr.com
• 031e39b9-e075-4b92-bc8c-b3573f193895.filesusr.com
• 6097fb04-7ba8-4b95-928c-a1efe2fc0efc.filesusr.com
• aeacac57-82f6-48db-af0c-cd17eb07d15a.filesusr.com
• 57658277-3b66-4a4e-beb8-e4dfcc50d4d1.filesusr.com
• 68a1a05d-3908-406c-9709-107562a3e5fe.filesusr.com
• ec8d66cd-493c-4cde-875a-44e26b5db311.filesusr.com
• d3cd654f-bff4-480e-a279-ddaca14ce48a.filesusr.com
• 6855af34-7ffd-4acd-8cff-47db9d210f10.filesusr.com
• 224ebdf5-0b00-4414-a4b7-96072c4e17b6.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report