MALICIOUS — 370ea2_338090f806d1423a8648a030bfdf88ab.pdf

MALICIOUS — 370ea2_338090f806d1423a8648a030bfdf88ab.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: c663242211d2f7f8a75f22c3aedcd764b988f804ffa0527070433dbcfb15637e
• SHA-1: deceeded67b4fbe5093292c5f07685d83bcb4190
• MD5: 5089489b47059063e3f72334f7b2823e
• ssdeep: 768:4gGzpDeqwSgBadr/8w26If3rxud3PMr3ILJmToUDYrhSx9Fo7:VGFqWfIgdfMr3I9mToPVSJo7
• TLSH: T1B9307CF3409BECCC7E8B9B03ADE622556185D78E7122E665549C3B6CC57C2ACBF40820
• Submitted as: 370ea2_338090f806d1423a8648a030bfdf88ab.pdf
• File type: pdf · Size: 36673 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=reading+explorer+4+teacher%2527s+guide+pdf, https://33f247c0-9e0b-4c98-9a67-e10ceead0c3a.filesusr.com/ugd/610d21_650437e5531d4779b8178b78f1568848.pdf?index=true, https://b29e27fb-0b5e-470d-8d3a-398c74d0ed6b.filesusr.com/ugd/405339_af66557d9fb4440c86cbd115ddf51319.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=reading+explorer+4+teacher%2527s+guide+pdf
• https://33f247c0-9e0b-4c98-9a67-e10ceead0c3a.filesusr.com/ugd/610d21_650437e5531d4779b8178b78f1568848.pdf?index=true
• https://b29e27fb-0b5e-470d-8d3a-398c74d0ed6b.filesusr.com/ugd/405339_af66557d9fb4440c86cbd115ddf51319.pdf?index=true
• https://98db7522-51b5-48f6-b3f3-9aee4d370d80.filesusr.com/ugd/d38238_9f4d9ff70f774212bb705f4a96c7ffc5.pdf?index=true
• https://cdn.shopify.com/s/files/1/0439/8877/9166/files/simone_de_beauvoir_espaol.pdf
• https://cdn.shopify.com/s/files/1/0433/0687/7080/files/dipipopiluniwewikojidil.pdf
• https://cdn.shopify.com/s/files/1/0441/2728/9496/files/98890567934.pdf
• https://cdn.shopify.com/s/files/1/0434/5335/0053/files/78047372410.pdf
• https://cdn.shopify.com/s/files/1/0480/7812/7268/files/pool_online_unblocked.pdf
• https://cdn.shopify.com/s/files/1/0429/5419/5097/files/ielts_recent_actual_test_reading.pdf
• https://cdn.shopify.com/s/files/1/0432/3239/5426/files/94058229492.pdf
• https://cba23d9f-93f6-4a7a-92c3-c4cb8a3e8d70.filesusr.com/ugd/89602e_c27b72734ab3458b8978ca2776c1aed7.pdf?index=true
• https://6055ecca-83ab-4c7d-baaa-c048ee7c1fa4.filesusr.com/ugd/595093_2ae88f320f7c4e1ea09f4f9773db9a0e.pdf?index=true
• https://8ab2c224-ad7f-41e6-81b8-2e17c777668e.filesusr.com/ugd/8a4248_0fb65a0302a24cdb8024234b5f9fb0f1.pdf?index=true
• https://92f85fa5-14e9-499d-93fd-6f97f249a21b.filesusr.com/ugd/60e703_627a775800744900971ba04e8f284a67.pdf?index=true
• https://d289d1a4-8e62-4d03-81d9-c4d15ed00306.filesusr.com/ugd/4fb05f_20a2953a990c4025964f01605a8d94d0.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• 33f247c0-9e0b-4c98-9a67-e10ceead0c3a.filesusr.com
• b29e27fb-0b5e-470d-8d3a-398c74d0ed6b.filesusr.com
• 98db7522-51b5-48f6-b3f3-9aee4d370d80.filesusr.com
• cdn.shopify.com
• cba23d9f-93f6-4a7a-92c3-c4cb8a3e8d70.filesusr.com
• 6055ecca-83ab-4c7d-baaa-c048ee7c1fa4.filesusr.com
• 8ab2c224-ad7f-41e6-81b8-2e17c777668e.filesusr.com
• 92f85fa5-14e9-499d-93fd-6f97f249a21b.filesusr.com
• d289d1a4-8e62-4d03-81d9-c4d15ed00306.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report