MALICIOUS — bca722_5a624299fbc14d118a3dc095e51679b5.pdf
MALICIOUS — bca722_5a624299fbc14d118a3dc095e51679b5.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
b1f5939708e72fac67af8cb396c39029773ddd2c9e4ff6df0b896fb488fd31d0 - SHA-1:
ad4080270074cd89fd61d1f9662b53b9862272ed - MD5:
f0ae6649984a31dfd9770d19ab1ee040 - ssdeep:
768:6gGzpDyETLsRatdjdeI0W1UUKcAUCY+TpRf1js09:nGFeGjsUCd1js09 - TLSH:
T1CE308DF314ABEC8C698BAB03ACAF155A554AC3886133976055C8373CD4BC6BDBF50461 - Submitted as: bca722_5a624299fbc14d118a3dc095e51679b5.pdf
- File type: pdf · Size: 35871 bytes
- Verdict: malicious (91/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
MITRE ATT&CK
Why this verdict
The malicious score of 91/100 is the fusion of 7 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule
UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded link rated suspicious by URL analysis: https://1f7757ca-f808-11ea-a328-fc4dd43d38a6.filesusr.com/ugd/5ccfc8_84a2f4303a114b63840edb0748c495db.pdf?index=true - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://ttraff.com/wix?keyword=obi+wan+kenobi+clone+wars+armor+cosplay, https://cdn.shopify.com/s/files/1/0433/4324/9576/files/bourbaki_general_topology_part_2.pdf, https://cdn.shopify.com/s/files/1/0438/7323/9195/files/cahier_de_charge_pour_site_web.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.com/wix?keyword=obi+wan+kenobi+clone+wars+armor+cosplay
- https://cdn.shopify.com/s/files/1/0433/4324/9576/files/bourbaki_general_topology_part_2.pdf
- https://cdn.shopify.com/s/files/1/0438/7323/9195/files/cahier_de_charge_pour_site_web.pdf
- https://cdn.shopify.com/s/files/1/0433/7146/2814/files/surgical_guide_for_crown_lengthening.pdf
- https://cdn.shopify.com/s/files/1/0434/5338/2822/files/d_d_starter_guide.pdf
- https://cdn.shopify.com/s/files/1/0433/7667/2918/files/free_touch_screen_mobile_games_download.pdf
- https://cdn.shopify.com/s/files/1/0436/7620/5209/files/counter_strike_1.6_ekran_bytme_if.pdf
- https://cdn.shopify.com/s/files/1/0438/4676/2656/files/misudiwalukiliwe.pdf
- https://cdn.shopify.com/s/files/1/0436/4104/5145/files/aadhar_card_app_android.pdf
- https://1f7757ca-f808-11ea-a328-fc4dd43d38a6.filesusr.com/ugd/5ccfc8_84a2f4303a114b63840edb0748c495db.pdf?index=true
- https://439b743d-8bcb-4035-b626-986e54f850cd.filesusr.com/ugd/54bec1_2de0f7ae7da746c18b6b3671510bcaac.pdf?index=true
- https://c59d6e42-7b16-4939-bb67-076e3059e20c.filesusr.com/ugd/dc8a8e_74efe0165fe340468e4e43f721ca4a2c.pdf?index=true
- https://19867a25-dc77-425f-97a9-ab14bda4a674.filesusr.com/ugd/9df9d6_d200703251a848a6b97a32655d8de01f.pdf?index=true
- https://1be078a9-2454-4e6a-b962-5fe1c5cc7052.filesusr.com/ugd/70e7d4_eb8ff9d506a047d69ddc303eb6261dfa.pdf?index=true
- https://cdn.shopify.com/s/files/1/0427/6797/4556/files/ruxudavikejixu.pdf
- https://cdn.shopify.com/s/files/1/0435/5555/3432/files/43125433655.pdf
- https://cdn.shopify.com/s/files/1/0429/4865/7318/files/grammar_handbook.pdf
- https://cdn.shopify.com/s/files/1/0433/8781/4044/files/whatsapp_apps_dijiye_karna_hai.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ttraff.com
- cdn.shopify.com
- 1f7757ca-f808-11ea-a328-fc4dd43d38a6.filesusr.com
- 439b743d-8bcb-4035-b626-986e54f850cd.filesusr.com
- c59d6e42-7b16-4939-bb67-076e3059e20c.filesusr.com
- 19867a25-dc77-425f-97a9-ab14bda4a674.filesusr.com
- 1be078a9-2454-4e6a-b962-5fe1c5cc7052.filesusr.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report