MALICIOUS — 1e52da_36b2ebb9a55c4536a045c10470c79cc1.pdf

MALICIOUS — 1e52da_36b2ebb9a55c4536a045c10470c79cc1.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: c6a4c1b63bab9a16b964155fb79584db004974a3de398676448021d7486d4cad
• SHA-1: bc895b785e77f766e54570aa39fc07750c673093
• MD5: 00d944a57c60d626194d97662ff9efe7
• ssdeep: 768:4gGzpDr7/2fnJVGP3Ap3yozL3+SmkSD8ykVOvIXNg3viaYkhp:VGF/GpJMND8ykLgf7Ykhp
• TLSH: T11832AFF35497EC8C2B8A5F07BDBB104D615ACB895133B6205498772CC5B8AFE6F05A20
• Submitted as: 1e52da_36b2ebb9a55c4536a045c10470c79cc1.pdf
• File type: pdf · Size: 45695 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=cheat+apk+hungry+shark, https://cdn.shopify.com/s/files/1/0428/4396/3548/files/35485654591.pdf, https://cdn.shopify.com/s/files/1/0433/0687/7080/files/pajakeveposemilakojataza.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=cheat+apk+hungry+shark
• https://cdn.shopify.com/s/files/1/0428/4396/3548/files/35485654591.pdf
• https://cdn.shopify.com/s/files/1/0433/0687/7080/files/pajakeveposemilakojataza.pdf
• https://cdn.shopify.com/s/files/1/0433/3902/2494/files/whaff_mod_apk.pdf
• https://cdn.shopify.com/s/files/1/0430/8205/5833/files/mezapizivoduvipenanog.pdf
• https://8269bf9f-a54c-49fe-9c31-900e2dd0b5cf.filesusr.com/ugd/dcc11b_e2f6d18bb5b54a789105bc37a5cf957c.pdf?index=true
• https://c46e530d-b21e-4b4b-a34f-647c9ad73c29.filesusr.com/ugd/735189_c0ec7dea54414bcf8072bb97ef273a4a.pdf?index=true
• https://cdn.shopify.com/s/files/1/0462/3997/3536/files/vikebelaberekolum.pdf
• https://cdn.shopify.com/s/files/1/0482/6739/5236/files/32190078840.pdf
• https://cdn.shopify.com/s/files/1/0434/0042/9731/files/rocefin_1g_im_bula.pdf
• https://cdn.shopify.com/s/files/1/0428/5625/1555/files/55981277588.pdf
• https://c669a215-2e96-40f1-8845-60b91b3cdb08.filesusr.com/ugd/cc14e4_7595c7cca8864aa89088f5600a00fecd.pdf?index=true
• https://47a3c176-eb10-4ee7-8020-e2e811083bf7.filesusr.com/ugd/3bcfef_ef2bcfa7cdd24b0d8c49d48eb3dfb154.pdf?index=true
• https://616c8f0e-b1ce-4d86-9e7a-e8dd1064d0d5.filesusr.com/ugd/9cfd0a_34bf62e667d24ddeb0387d4396d076d1.pdf?index=true
• https://6f2a3e62-8287-42b6-809b-c84334d9dc61.filesusr.com/ugd/35c6e2_2059b52814764830a4fa6d03ab5a600d.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• cdn.shopify.com
• 8269bf9f-a54c-49fe-9c31-900e2dd0b5cf.filesusr.com
• c46e530d-b21e-4b4b-a34f-647c9ad73c29.filesusr.com
• c669a215-2e96-40f1-8845-60b91b3cdb08.filesusr.com
• 47a3c176-eb10-4ee7-8020-e2e811083bf7.filesusr.com
• 616c8f0e-b1ce-4d86-9e7a-e8dd1064d0d5.filesusr.com
• 6f2a3e62-8287-42b6-809b-c84334d9dc61.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report