MALICIOUS — 3be48b_dc929480c87a4ea1aa0237eea6cef4cf.pdf
MALICIOUS — 3be48b_dc929480c87a4ea1aa0237eea6cef4cf.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
c94d6840e92bcb36f5a00450be451cac552abd306fd209a13e43ad0dfaeca16e - SHA-1:
bc6ca090b5b11c3fc7d9954f6014aa3624135364 - MD5:
4af666f346fb5c563ecd9c9ab4e0873a - ssdeep:
768:agGzpDhX2vdosXgb7Fu0uZU0x5ZfTTNMLDCzrBJxJ/cKRYqt8d8chw0iE1eBm/r:HGFVs67YVlpfTTJ/r/LSSibzeBm/r - TLSH:
T1DB33BFF3409BED4C36879F136AD610BDB086D6C860739A7854D8BA6CC87C3BD6E50921 - Submitted as: 3be48b_dc929480c87a4ea1aa0237eea6cef4cf.pdf
- File type: pdf · Size: 50473 bytes
- Verdict: malicious (78/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The malicious score of 78/100 is the fusion of 5 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ttraff.me/wix?keyword=digimon+fusion+games+apk, https://4e350dfe-8f07-4743-978b-a32cb38836c6.filesusr.com/ugd/97634b_6b17a1b4a74c473e9389c8c4cca37263.pdf?index=true, https://67dd3830-0cc7-48e6-9b89-11dd94f47f04.filesusr.com/ugd/ce14f3_c34edeb79c214155856a9d1627b5f2a5.pdf?index=true - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
1004 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- searchapp.bundleassets.example
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ntp.ubuntu.com
- 192.168.122.105
- 224.0.0.252
- 192.168.122.255
- 192.168.122.1
- 192.168.122.114
- 169.254.36.201
- 192.168.122.109
- 192.168.122.116
- 192.168.122.115
- 192.168.122.108
- 169.254.102.168
Dropped files
- root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://ttraff.me/wix?keyword=digimon+fusion+games+apk
- https://4e350dfe-8f07-4743-978b-a32cb38836c6.filesusr.com/ugd/97634b_6b17a1b4a74c473e9389c8c4cca37263.pdf?index=true
- https://67dd3830-0cc7-48e6-9b89-11dd94f47f04.filesusr.com/ugd/ce14f3_c34edeb79c214155856a9d1627b5f2a5.pdf?index=true
- https://943f350b-d1e4-4e20-9f68-08771b6594b0.filesusr.com/ugd/70e7d4_d9bf5e2f3463454198d255dd2e8390d1.pdf?index=true
- https://af515ab5-cf09-45e0-a83e-119793525d67.filesusr.com/ugd/3ceeb9_56faf643200c4d7a97602dfa366f9390.pdf?index=true
- https://ae2465f5-d307-4222-9abf-8520e2214960.filesusr.com/ugd/9ef0c3_3868b58add684fa7bd709d20a986637f.pdf?index=true
- https://1a9b364d-01a8-4ec8-834e-f88138dd2a4d.filesusr.com/ugd/5e8de6_7f0c4d1de80445109fa4acf89e30f091.pdf?index=true
- https://c92b945c-7a72-42a6-b239-ce25e2a46ada.filesusr.com/ugd/938c70_5916c029092e403187c3e826c17466cb.pdf?index=true
- https://a1fb874c-a494-4b9a-9a61-763ccde96405.filesusr.com/ugd/0cd019_2da0596d22eb4c4e87843ce735af3d60.pdf?index=true
- https://7852436b-fa34-4a05-9d2b-15701832fec3.filesusr.com/ugd/733c1f_0c50a8adfad34a919127be119dc6e555.pdf?index=true
- https://4e6f8308-4f45-46de-aa9f-9ccbad9ecd38.filesusr.com/ugd/2994dd_0cccbf8e47034726a5e7012d9dec7896.pdf?index=true
- https://79e1b786-f85d-4b86-b601-f875d1b0b4b2.filesusr.com/ugd/d01287_6692de75b6694fb280ee3675f7b14449.pdf?index=true
- https://14a19012-22ba-4488-8586-f70a0944b848.filesusr.com/ugd/61567a_f5856c03a1504fee92d654e09ea3e52c.pdf?index=true
- https://07b7decd-e1be-4fab-8ddb-2dfcc8b7b434.filesusr.com/ugd/33a2e4_62f0c4486f46408f927ac3f3171a334a.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ttraff.me
- 4e350dfe-8f07-4743-978b-a32cb38836c6.filesusr.com
- 67dd3830-0cc7-48e6-9b89-11dd94f47f04.filesusr.com
- 943f350b-d1e4-4e20-9f68-08771b6594b0.filesusr.com
- af515ab5-cf09-45e0-a83e-119793525d67.filesusr.com
- ae2465f5-d307-4222-9abf-8520e2214960.filesusr.com
- 1a9b364d-01a8-4ec8-834e-f88138dd2a4d.filesusr.com
- c92b945c-7a72-42a6-b239-ce25e2a46ada.filesusr.com
- a1fb874c-a494-4b9a-9a61-763ccde96405.filesusr.com
- 7852436b-fa34-4a05-9d2b-15701832fec3.filesusr.com
- 4e6f8308-4f45-46de-aa9f-9ccbad9ecd38.filesusr.com
- 79e1b786-f85d-4b86-b601-f875d1b0b4b2.filesusr.com
- 14a19012-22ba-4488-8586-f70a0944b848.filesusr.com
- 07b7decd-e1be-4fab-8ddb-2dfcc8b7b434.filesusr.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report