MALICIOUS — 4ca7f5_aaa28b33c45a4c3f98fc56851f9c66fa.pdf

MALICIOUS — 4ca7f5_aaa28b33c45a4c3f98fc56851f9c66fa.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: bcda44386636e4405f349bf4d681209c5b9b9ee62149481a62f2fe9efecd1b11
• SHA-1: c8f6ba11c813ae0483f840ddfd8032c248f869ef
• MD5: efacd48bc3258a7389ea8a2b0f189831
• ssdeep: 768:7gGzpDWyAkeIkDfQyGn45fh/y+I4A6uKd5hjA+nzUzoYh5xUi8rEu8otU48v:EGFyI4f85wU+zUcYp9wn8v
• TLSH: T142317DF350A7ED8C7A4EDB076DDA11196089D78C6032AAA0059C6B2CD4BC2FD7F10E61
• Submitted as: 4ca7f5_aaa28b33c45a4c3f98fc56851f9c66fa.pdf
• File type: pdf · Size: 40853 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=accelerated+reader+answer+key+for+hunger+games, https://dbbad3d7-5075-4501-bb26-3b5493457a96.filesusr.com/ugd/18f527_ec20d68874224603b333e41ddc4c0d3f.pdf?index=true, https://816827e9-4a9b-4988-80e1-87ddb33a5903.filesusr.com/ugd/625844_a41af182529a45e486099fb7202fb9dc.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=accelerated+reader+answer+key+for+hunger+games
• https://dbbad3d7-5075-4501-bb26-3b5493457a96.filesusr.com/ugd/18f527_ec20d68874224603b333e41ddc4c0d3f.pdf?index=true
• https://816827e9-4a9b-4988-80e1-87ddb33a5903.filesusr.com/ugd/625844_a41af182529a45e486099fb7202fb9dc.pdf?index=true
• https://d45c54e3-11b0-4e58-8f13-2b1adf1c57fa.filesusr.com/ugd/740d8c_fec13985938543e1a22e67f49b44b0c5.pdf?index=true
• https://4ad4b049-a5ab-428c-9b22-944b9a4f4b1e.filesusr.com/ugd/a58b01_b74711578ef64b079092e74a85d89227.pdf?index=true
• https://e6be664e-4b8e-4bc6-a7c2-5e24d63ecffb.filesusr.com/ugd/98e2de_30a800d726cd4920997ddd999aa49026.pdf?index=true
• https://cdn.shopify.com/s/files/1/0431/2514/5760/files/bejusadugogupo.pdf
• https://cdn.shopify.com/s/files/1/0435/1610/0776/files/a_love_to_last_july_13th_on_a_friday.pdf
• https://cdn.shopify.com/s/files/1/0430/3834/3322/files/vorusoxagewa.pdf
• https://cdn.shopify.com/s/files/1/0428/0962/2687/files/archilochus_poems.pdf
• https://cdn.shopify.com/s/files/1/0431/9464/6689/files/auggie_and_me_book.pdf
• https://cdn.shopify.com/s/files/1/0434/3418/0769/files/80798446628.pdf
• https://cdn.shopify.com/s/files/1/0434/9719/3638/files/rafabimepagipejukisisu.pdf
• https://cdn.shopify.com/s/files/1/0430/3912/9751/files/the_grimm_brothers_cinderella.pdf
• https://cdn.shopify.com/s/files/1/0453/9623/0312/files/free_speaker_volume_booster_for_laptop.pdf
• https://cdn.shopify.com/s/files/1/0430/0043/0746/files/95004765052.pdf
• https://cdn.shopify.com/s/files/1/0431/9703/8756/files/17736211437.pdf
• https://cdn.shopify.com/s/files/1/0433/8617/5651/files/nilosinafekajatasi.pdf
• https://cdn.shopify.com/s/files/1/0429/5317/9289/files/jujusoli.pdf
• https://cdn.shopify.com/s/files/1/0440/6758/6213/files/tekoforugotugusu.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/

Embedded domains

• ttraff.cc
• dbbad3d7-5075-4501-bb26-3b5493457a96.filesusr.com
• 816827e9-4a9b-4988-80e1-87ddb33a5903.filesusr.com
• d45c54e3-11b0-4e58-8f13-2b1adf1c57fa.filesusr.com
• 4ad4b049-a5ab-428c-9b22-944b9a4f4b1e.filesusr.com
• e6be664e-4b8e-4bc6-a7c2-5e24d63ecffb.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report