MALICIOUS — d2cc1f_8435671658354aa3a937939f82a3e127.pdf

MALICIOUS — d2cc1f_8435671658354aa3a937939f82a3e127.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: b1f9a91c7a25535f476859cda273c85075cb0e980400b05654edd753094fb5b6
• SHA-1: f98225b402ca2f77144764bac01ea47b2d9265cd
• MD5: 54a3d3ecfbc948319915b9531608aea0
• ssdeep: 768:UgGzpDYcMFfbhHesYx+1q8MOWA0fiYn0Z0SvTa0KMeHiTh:hGFMjTrBtHqiYn3c7eHiV
• TLSH: T1E9306CF32097ED8C7A879F03AEEA111D9585D6886033E6205598772CD4BC3BDBF50960
• Submitted as: d2cc1f_8435671658354aa3a937939f82a3e127.pdf
• File type: pdf · Size: 38509 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=panti+sisters+netflix, https://546ed2a1-e0e8-4c92-aca8-6689911f9f88.filesusr.com/ugd/440e29_47bcfaefc64c4206b59962c66f711caa.pdf?index=true, https://bce42d04-672c-4f99-a214-822bb3acca77.filesusr.com/ugd/c57cae_f14112b278e34403985cae7407be8557.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=panti+sisters+netflix
• https://546ed2a1-e0e8-4c92-aca8-6689911f9f88.filesusr.com/ugd/440e29_47bcfaefc64c4206b59962c66f711caa.pdf?index=true
• https://bce42d04-672c-4f99-a214-822bb3acca77.filesusr.com/ugd/c57cae_f14112b278e34403985cae7407be8557.pdf?index=true
• https://9b8e3f72-b375-402f-9005-0092637732fe.filesusr.com/ugd/5aec95_ee680645975b4021a348000e3710492e.pdf?index=true
• https://509e6cfe-a66f-4696-b430-c3e7fd368600.filesusr.com/ugd/5de1df_67f5ea948cb14fdd99da880f1470570b.pdf?index=true
• https://55021bc4-83e3-42cb-ad44-1edabf442713.filesusr.com/ugd/5b9a87_6b727dba4c0845dc87a6a8712b00e320.pdf?index=true
• https://cdn.shopify.com/s/files/1/0436/2951/0814/files/final_fantasy_ix_strategy_guide.pdf
• https://cdn.shopify.com/s/files/1/0428/9550/7622/files/sinifaxotuwozebubebukukit.pdf
• https://cdn.shopify.com/s/files/1/0429/7926/2615/files/adobe_creative_cloud_cleaner_tool.pdf
• https://cdn.shopify.com/s/files/1/0432/3262/4797/files/silevowabonekoxosowufoso.pdf
• https://cdn.shopify.com/s/files/1/0432/0195/3952/files/89484617871.pdf
• https://cdn.shopify.com/s/files/1/0431/5119/6314/files/xexirufuz.pdf
• https://cdn.shopify.com/s/files/1/0433/8683/0998/files/vafawulogageli.pdf
• https://77016877-fd38-45dd-94e6-c9ec2783b4ef.filesusr.com/ugd/eda9ba_cac20e733646480495d3b80894514074.pdf?index=true
• https://bcbb4772-f9f5-4a20-a6f9-8edf17353c5f.filesusr.com/ugd/edb4a7_ee4e9dd5da6d44c383dc1219c826e520.pdf?index=true
• https://95098b48-7415-4008-8e04-a13492320f98.filesusr.com/ugd/48bf55_01a2f1b568ac4b69a238959181156526.pdf?index=true
• https://4e840cdb-8fc4-4d32-8698-ff8c97a74d81.filesusr.com/ugd/5dc3ca_627691f57b0c41318396f8d22b3a1b27.pdf?index=true
• https://0c44fbc9-f64e-4932-bd0e-06ea1483b9d1.filesusr.com/ugd/163759_abb0318983074de3ada9160e38aeb200.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• 546ed2a1-e0e8-4c92-aca8-6689911f9f88.filesusr.com
• bce42d04-672c-4f99-a214-822bb3acca77.filesusr.com
• 9b8e3f72-b375-402f-9005-0092637732fe.filesusr.com
• 509e6cfe-a66f-4696-b430-c3e7fd368600.filesusr.com
• 55021bc4-83e3-42cb-ad44-1edabf442713.filesusr.com
• cdn.shopify.com
• 77016877-fd38-45dd-94e6-c9ec2783b4ef.filesusr.com
• bcbb4772-f9f5-4a20-a6f9-8edf17353c5f.filesusr.com
• 95098b48-7415-4008-8e04-a13492320f98.filesusr.com
• 4e840cdb-8fc4-4d32-8698-ff8c97a74d81.filesusr.com
• 0c44fbc9-f64e-4932-bd0e-06ea1483b9d1.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report