MALICIOUS — 952c2e_334673c3963b4bd7a0121c1e002cbead.pdf

MALICIOUS — 952c2e_334673c3963b4bd7a0121c1e002cbead.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: ba570c560adbd0845aac8d9506f0775f6643026dd1b3add56830e18feb05a166
• SHA-1: 601e2395111756c24bedf3da0cc937a95b61675a
• MD5: b3856ac38ff8aaacf97fc69b4a742407
• ssdeep: 1536:JGFun30j2ShL8oTtIkH+f0DWHHcsWaN0:cFu30u30iWb
• TLSH: T1FA339DF340CBED8C7A8B9F43ADEB11596046D7893222B69194D83A6CC07C3BD6E44D60
• Submitted as: 952c2e_334673c3963b4bd7a0121c1e002cbead.pdf
• File type: pdf · Size: 51833 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=kinemaster+for+pc+online, https://2fa6cfec-9b82-4dcc-8213-42ec53f388a1.filesusr.com/ugd/8e7730_a1528b8e84b743b8b0b647321ee1c890.pdf?index=true, https://3fcc6b2d-d62f-42ae-942d-0682dc10d326.filesusr.com/ugd/3bcfef_b0c79e978884403eb1ebe414ee136c6d.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=kinemaster+for+pc+online
• https://2fa6cfec-9b82-4dcc-8213-42ec53f388a1.filesusr.com/ugd/8e7730_a1528b8e84b743b8b0b647321ee1c890.pdf?index=true
• https://3fcc6b2d-d62f-42ae-942d-0682dc10d326.filesusr.com/ugd/3bcfef_b0c79e978884403eb1ebe414ee136c6d.pdf?index=true
• https://04f581e7-da1f-4b43-b352-452121160611.filesusr.com/ugd/0b46e6_f6585cd5c920478d995134440207e5cf.pdf?index=true
• https://ff404bf9-8d38-43da-83b5-fdfd74edb86a.filesusr.com/ugd/2e4eb4_ea84062ddcb84523b7992c1c7fbb3818.pdf?index=true
• https://bea36fca-46f8-472f-b18f-a0512efc2dec.filesusr.com/ugd/2994dd_de515d80c62340bc9c166b180236db55.pdf?index=true
• https://a9a5e5f7-d9b5-488a-bc5a-d66ad6ab29da.filesusr.com/ugd/682d1c_9f6fd829ac85424f8897a84137e57dd6.pdf?index=true
• https://810848cc-d0c6-4fe6-b5f7-4c3aa6beb65e.filesusr.com/ugd/8ce377_1d705e23d55e489f965b71f4454d4f23.pdf?index=true
• https://68c47119-41a7-4e9e-9c48-c65c58db81c0.filesusr.com/ugd/3f0e57_bb58c8fa78a049448b3bc87739ea0dc8.pdf?index=true
• https://349ccfdd-819c-4a35-b9b6-9404475a5e36.filesusr.com/ugd/154db6_018e0cf3f1f6434a8c8fbcfdbba80286.pdf?index=true
• https://97a090fa-1c0b-4928-a230-bdc1397abeee.filesusr.com/ugd/f35da0_c224020a6de148f39cde6f0c30a0bdcf.pdf?index=true
• https://19724b25-c8ec-47c5-9a20-f9466b6a1402.filesusr.com/ugd/4c7633_97158e09ed174f81937a1b7afef8dc82.pdf?index=true
• https://0c6ccf54-73e4-49b7-b7d4-6f3a47fe88a8.filesusr.com/ugd/145364_60fa9fd055a64db4a7638ae065e20a3a.pdf?index=true
• https://dca47d51-590a-426c-846c-6212a50484be.filesusr.com/ugd/8ce377_83b7f1ebd5b8497c88eee5d746452021.pdf?index=true
• https://0ba7a6cc-4c8d-4c69-abc1-cc08b7574cb4.filesusr.com/ugd/529dbf_1e1a17d4401042a485de9f2fbaebf2a8.pdf?index=true
• https://f512bf10-37cb-4a46-8cb5-241a66d867a0.filesusr.com/ugd/dcc11b_c04ed2104ee045e1a0ad4de688cab58d.pdf?index=true
• https://e92f4c1f-6a69-433c-9558-1c77c13d4329.filesusr.com/ugd/c5d40f_edebab09dbe14329b1be796a913f282d.pdf?index=true
• https://cbafcfd8-b3a0-4f12-98f6-ea01b216f298.filesusr.com/ugd/ceb2e8_3916b828144f4d199cbfae3e0debde8c.pdf?index=true
• https://ba986bd7-4b89-46a5-85e3-052755aa2964.filesusr.com/ugd/682d1c_037d700f08614be2a9068465e6136d76.pdf?index=true
• https://97d97908-a618-4827-bd6b-adf08b790031.filesusr.com/ugd/e3ff21_e1b127f6dce643528a45ba3b49e3fdc4.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/

Embedded domains

• ttraff.link
• 2fa6cfec-9b82-4dcc-8213-42ec53f388a1.filesusr.com
• 3fcc6b2d-d62f-42ae-942d-0682dc10d326.filesusr.com
• 04f581e7-da1f-4b43-b352-452121160611.filesusr.com
• ff404bf9-8d38-43da-83b5-fdfd74edb86a.filesusr.com
• bea36fca-46f8-472f-b18f-a0512efc2dec.filesusr.com
• a9a5e5f7-d9b5-488a-bc5a-d66ad6ab29da.filesusr.com
• 810848cc-d0c6-4fe6-b5f7-4c3aa6beb65e.filesusr.com
• 68c47119-41a7-4e9e-9c48-c65c58db81c0.filesusr.com
• 349ccfdd-819c-4a35-b9b6-9404475a5e36.filesusr.com
• 97a090fa-1c0b-4928-a230-bdc1397abeee.filesusr.com
• 19724b25-c8ec-47c5-9a20-f9466b6a1402.filesusr.com
• 0c6ccf54-73e4-49b7-b7d4-6f3a47fe88a8.filesusr.com
• dca47d51-590a-426c-846c-6212a50484be.filesusr.com
• 0ba7a6cc-4c8d-4c69-abc1-cc08b7574cb4.filesusr.com
• f512bf10-37cb-4a46-8cb5-241a66d867a0.filesusr.com
• e92f4c1f-6a69-433c-9558-1c77c13d4329.filesusr.com
• cbafcfd8-b3a0-4f12-98f6-ea01b216f298.filesusr.com
• ba986bd7-4b89-46a5-85e3-052755aa2964.filesusr.com
• 97d97908-a618-4827-bd6b-adf08b790031.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report