MALICIOUS — 90423f_2ea7a36471964c18ab9ecd2875aaca4f.pdf

MALICIOUS — 90423f_2ea7a36471964c18ab9ecd2875aaca4f.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: c9c5e98ee2eeb2cd47bec81c6771367786b77bbc7a867c07484b8f6b69879a8e
• SHA-1: 2ee9e6e6d51e46fd5ceb8e2cdd2a94d092c24bc0
• MD5: f28021485c9c70197edf4096d2f63419
• ssdeep: 1536:+GF68dqCPVBP6VB/9lEfsdzFlm2wGRomczuN4/a38BWlKGdeCSXw:nF68dvHPY/9u8plm2wGemcwWVUNdp
• TLSH: T17939E0F34093ED8C7ACD7B036F96171C6046E28E6122D6B488CDB76CD9781BD6E40A61
• Submitted as: 90423f_2ea7a36471964c18ab9ecd2875aaca4f.pdf
• File type: pdf · Size: 84756 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=similarities+of+slavery+and+indentured+servitude, https://479e3240-bf84-40cc-a6ef-5afefc4253df.filesusr.com/ugd/9ff9b8_b128dd6b7c4146f99bdf3c1a167ddd79.pdf?index=true, https://8ec84561-041d-460b-98e9-03cff5bdda39.filesusr.com/ugd/4aae87_dd1bfcc9275a481ab154330f236b9e72.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=similarities+of+slavery+and+indentured+servitude
• https://479e3240-bf84-40cc-a6ef-5afefc4253df.filesusr.com/ugd/9ff9b8_b128dd6b7c4146f99bdf3c1a167ddd79.pdf?index=true
• https://8ec84561-041d-460b-98e9-03cff5bdda39.filesusr.com/ugd/4aae87_dd1bfcc9275a481ab154330f236b9e72.pdf?index=true
• https://1b2b8f95-8c7f-4eb5-a4bf-bde5aa026b20.filesusr.com/ugd/e1c37d_515b971aea144b3a899d74ee11d7f9db.pdf?index=true
• http://files.camppepper.com/uploads/1/3/2/3/132302913/1217584.pdf
• http://surobemi.roxelpta.org/uploads/1/3/1/1/131164104/wimabubakaxeluj_jikonuvosefilug_rifetak_ziwipijozoti.pdf
• http://jivefon.arizonacondemnationlawyers.com/uploads/1/3/1/3/131383483/336c0d.pdf
• https://30568a1b-ef88-4909-9e76-65d4565507b3.filesusr.com/ugd/bc4951_2798d97c1ab0428eb940c25e94e7c97c.pdf?index=true
• https://fbf4e847-cca6-4a9c-80f5-acb56d07fdc2.filesusr.com/ugd/dcf311_ce1d1c20277b4708bf0e1fde87370671.pdf?index=true
• https://35adb2cc-715b-45f7-a8b5-0c91544934b7.filesusr.com/ugd/b13fd1_3b9398fd474043a786cc470c80910f6b.pdf?index=true
• https://8daffdb7-b95f-4860-865d-fe7ec77ec3c9.filesusr.com/ugd/9058e5_22c4a17998e74fe88f89ca2d681b4fe0.pdf?index=true
• https://3e4f4a2a-d825-48c0-9f07-b388d0746714.filesusr.com/ugd/c722c2_caa42a435b01438db8f022ff448b6e00.pdf?index=true
• https://72621f66-de6a-4d3a-bc37-cc3a844785e7.filesusr.com/ugd/cfa91a_94d54d7ca0a449168fd3b460d3d5d00f.pdf?index=true
• https://d633090a-0370-49ee-a364-178749e79d15.filesusr.com/ugd/f6336d_a76d36da138d446ab5659af3444a78b3.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• 479e3240-bf84-40cc-a6ef-5afefc4253df.filesusr.com
• 8ec84561-041d-460b-98e9-03cff5bdda39.filesusr.com
• 1b2b8f95-8c7f-4eb5-a4bf-bde5aa026b20.filesusr.com
• files.camppepper.com
• surobemi.roxelpta.org
• jivefon.arizonacondemnationlawyers.com
• 30568a1b-ef88-4909-9e76-65d4565507b3.filesusr.com
• fbf4e847-cca6-4a9c-80f5-acb56d07fdc2.filesusr.com
• 35adb2cc-715b-45f7-a8b5-0c91544934b7.filesusr.com
• 8daffdb7-b95f-4860-865d-fe7ec77ec3c9.filesusr.com
• 3e4f4a2a-d825-48c0-9f07-b388d0746714.filesusr.com
• 72621f66-de6a-4d3a-bc37-cc3a844785e7.filesusr.com
• d633090a-0370-49ee-a364-178749e79d15.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report