MALICIOUS — 8a4248_0fb65a0302a24cdb8024234b5f9fb0f1.pdf
MALICIOUS — 8a4248_0fb65a0302a24cdb8024234b5f9fb0f1.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
ae2714e950acf82965cf2610571e0549e49bd725401b00518dc7571d30c2f6a7 - SHA-1:
213221472c5576d583ebf93b8d83a7d10d85a4d0 - MD5:
908a6a1c542576676b92626affbdcc51 - ssdeep:
768:NgGzpDB/nS/0ewa/DjXptGahlaQxKeCE2U/1t1FO/8Ib6PYgdVG:uGFl/iDDXa+GE2U/1tjHI2wgdVG - TLSH:
T13832AFF350A7EC4C3B8BAB03E9EA105C218AD68D2126E69109D8377DC8786FDBF10551 - Submitted as: 8a4248_0fb65a0302a24cdb8024234b5f9fb0f1.pdf
- File type: pdf · Size: 44244 bytes
- Verdict: malicious (78/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The malicious score of 78/100 is the fusion of 5 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ttraff.com/wix?keyword=pokemon+alpha+sapphire+nds+rom+deutsch, https://cdn.shopify.com/s/files/1/0435/3549/9418/files/32322110504.pdf, https://cdn.shopify.com/s/files/1/0432/4936/9252/files/dalineguwiwufejilajoz.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.com/wix?keyword=pokemon+alpha+sapphire+nds+rom+deutsch
- https://cdn.shopify.com/s/files/1/0435/3549/9418/files/32322110504.pdf
- https://cdn.shopify.com/s/files/1/0432/4936/9252/files/dalineguwiwufejilajoz.pdf
- https://cdn.shopify.com/s/files/1/0431/2206/5557/files/12309635360.pdf
- https://cdn.shopify.com/s/files/1/0433/8827/2805/files/cooperative_business_services_annual_report.pdf
- https://cdn.shopify.com/s/files/1/0437/8768/1954/files/nimizegaverunuzuti.pdf
- https://cdn.shopify.com/s/files/1/0433/8381/6359/files/kevuzejazadamaxotole.pdf
- https://cdn.shopify.com/s/files/1/0431/4877/1477/files/zudapezuveb.pdf
- https://cdn.shopify.com/s/files/1/0432/2613/6743/files/data_structures_and_algorithms_in_python_2020.pdf
- https://18ed90a5-c6d0-47bf-8045-068df66419c1.filesusr.com/ugd/2e4eb4_fd000ddd78bd4c2f81ec8675f89f31d1.pdf?index=true
- https://ea4e2ebc-698b-463a-90b5-058f2e303631.filesusr.com/ugd/529dbf_4ce0f6cdba694e139e9e0caf2d21e14f.pdf?index=true
- https://cd807b47-f4c9-4cd2-8eaa-bbca02502f71.filesusr.com/ugd/8bf3fc_438af720ccde42aba4d2def5164e8e03.pdf?index=true
- https://68c47119-41a7-4e9e-9c48-c65c58db81c0.filesusr.com/ugd/3f0e57_bb58c8fa78a049448b3bc87739ea0dc8.pdf?index=true
- https://264d23b7-0083-4e7e-b0cd-b29d6c8bac00.filesusr.com/ugd/17ce20_46d2aca14a0046bcaaae0fb0df44d989.pdf?index=true
- https://f4f73914-4b6f-4688-8c35-a8cc06216d52.filesusr.com/ugd/035627_beb0acd5f3a747aeb8ff12bcd49b6fbe.pdf?index=true
- https://2cdc0cb1-2bb9-41b0-8309-a0380b4b8b7c.filesusr.com/ugd/ac8c68_dd20c454b3694f6194d7eadcd3e5e724.pdf?index=true
- https://7ae49176-0174-4cf3-8ae5-fde30fa7fd24.filesusr.com/ugd/f08e01_ab024f7090bf47e3a1b718d16d38400b.pdf?index=true
- https://94113679-9e86-43e1-95f3-e09a4be24047.filesusr.com/ugd/0582e0_cad751bcaaa7440a8456a70b63d0a0b4.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ttraff.com
- cdn.shopify.com
- 18ed90a5-c6d0-47bf-8045-068df66419c1.filesusr.com
- ea4e2ebc-698b-463a-90b5-058f2e303631.filesusr.com
- cd807b47-f4c9-4cd2-8eaa-bbca02502f71.filesusr.com
- 68c47119-41a7-4e9e-9c48-c65c58db81c0.filesusr.com
- 264d23b7-0083-4e7e-b0cd-b29d6c8bac00.filesusr.com
- f4f73914-4b6f-4688-8c35-a8cc06216d52.filesusr.com
- 2cdc0cb1-2bb9-41b0-8309-a0380b4b8b7c.filesusr.com
- 7ae49176-0174-4cf3-8ae5-fde30fa7fd24.filesusr.com
- 94113679-9e86-43e1-95f3-e09a4be24047.filesusr.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report