MALICIOUS — 314c35_278f86fa39234e5e83816ff980e74013.pdf

MALICIOUS — 314c35_278f86fa39234e5e83816ff980e74013.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: b727ddea97afa9ddc266fe2025105689cca5d912ef18ac4ff28c463efee0b0a3
• SHA-1: 83684b44b4ec16970ba23deca559cde8500ffea2
• MD5: 141a41bcfe320bc5a6f372ce5b614c13
• ssdeep: 768:RgGzpDtfG0N5EGjl6+N/RAlgKGWcxhNN+Tuxr4IXZFaJCHiw0+r7Nvk:iGFZfx3WcHqsbpExhu7Nvk
• TLSH: T14432ADF34097ED4C7686AF076DEB158A608AD24D6033E360089C776CD8BC2BD6E509A1
• Submitted as: 314c35_278f86fa39234e5e83816ff980e74013.pdf
• File type: pdf · Size: 43519 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.PDF.Agent.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.PDF.Agent.gen (rule HEUR:Trojan.PDF.Agent.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=blue+and+green+baby+shower+cake, https://27c137e3-fa5b-4771-a867-77f7cd6a4ecd.filesusr.com/ugd/6e3131_bd9e529a62384a079a129bbb6a2c1e8c.pdf?index=true, https://0a9d55f0-de10-4fce-b2f9-da4c3c2ba4c1.filesusr.com/ugd/f09a9d_d572f6a7a4974139b44e7eb543605b03.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=blue+and+green+baby+shower+cake
• https://27c137e3-fa5b-4771-a867-77f7cd6a4ecd.filesusr.com/ugd/6e3131_bd9e529a62384a079a129bbb6a2c1e8c.pdf?index=true
• https://0a9d55f0-de10-4fce-b2f9-da4c3c2ba4c1.filesusr.com/ugd/f09a9d_d572f6a7a4974139b44e7eb543605b03.pdf?index=true
• https://1b2cf6bf-c2a6-4509-8b42-ce86efc9c48b.filesusr.com/ugd/10b03a_ea87b7d867004f4eb6728288cdf88982.pdf?index=true
• https://7fc96d01-d195-469b-861f-8919446b9d1a.filesusr.com/ugd/f09a9d_473747cea5124a6dabf264962ea4f102.pdf?index=true
• https://6b1c5669-184c-41cc-8232-42aff931fc72.filesusr.com/ugd/8c0e65_50821a07cddf4e5a877919c5b6caddaf.pdf?index=true
• http://files.angusclassicenthusiasts.com/uploads/1/3/2/6/132695336/59494cc.pdf
• http://jotebu.theyardkemah.com/uploads/1/3/1/3/131382539/5c3caf9.pdf
• https://cdn.shopify.com/s/files/1/0431/2717/7365/files/vadelubumaxirikekosip.pdf
• https://cdn.shopify.com/s/files/1/0437/0700/7127/files/denosegadesukasiweper.pdf
• https://cdn.shopify.com/s/files/1/0463/6380/3803/files/salary_negotiation_with_hr_questions_and_answers.pdf
• https://cdn.shopify.com/s/files/1/0430/1615/9381/files/revoporuran.pdf
• https://cdn.shopify.com/s/files/1/0436/2944/5273/files/78691439294.pdf
• https://cdn.shopify.com/s/files/1/0479/3522/6023/files/mepew.pdf
• https://cdn.shopify.com/s/files/1/0429/1674/1283/files/how_to_make_a_discord_rules_channel.pdf
• https://cdn.shopify.com/s/files/1/0440/6847/0936/files/94378038448.pdf
• https://cdn.shopify.com/s/files/1/0428/3134/7868/files/fusiform_bacilli_and_spirochetes.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• 27c137e3-fa5b-4771-a867-77f7cd6a4ecd.filesusr.com
• 0a9d55f0-de10-4fce-b2f9-da4c3c2ba4c1.filesusr.com
• 1b2cf6bf-c2a6-4509-8b42-ce86efc9c48b.filesusr.com
• 7fc96d01-d195-469b-861f-8919446b9d1a.filesusr.com
• 6b1c5669-184c-41cc-8232-42aff931fc72.filesusr.com
• files.angusclassicenthusiasts.com
• jotebu.theyardkemah.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report