MALICIOUS — 0582e0_51cf84368de4446daf6161596c160b5f.pdf

MALICIOUS — 0582e0_51cf84368de4446daf6161596c160b5f.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: cc4e7cba8108baf0358672bd7f2b801208018d61d66dd41c6b3e7013753070bb
• SHA-1: 747548dfe8e7a328b88a80a76a5c50e54b22a338
• MD5: c9423de00511a3fee6ab8b93ea491563
• ssdeep: 768:vbgGzpDVAPKOpirCD+PZmpjPRBS07TfAFXz/2OdLzoaAmu6ml+:8GFBCRI04Bq+U/6ml+
• TLSH: T111319DF354A3ECCD7A8A6B13AEEB151E5049D34D613396A0148C372CD47C2BDBE10A22
• Submitted as: 0582e0_51cf84368de4446daf6161596c160b5f.pdf
• File type: pdf · Size: 43197 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=nadal+live+stream+wimbledon, https://cdn.shopify.com/s/files/1/0429/2627/6775/files/poneratibetupitarizofob.pdf, https://cdn.shopify.com/s/files/1/0441/1500/1496/files/durefenasozakekilotereti.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=nadal+live+stream+wimbledon
• https://cdn.shopify.com/s/files/1/0429/2627/6775/files/poneratibetupitarizofob.pdf
• https://cdn.shopify.com/s/files/1/0441/1500/1496/files/durefenasozakekilotereti.pdf
• https://cdn.shopify.com/s/files/1/0438/9522/6523/files/38783837954.pdf
• https://cdn.shopify.com/s/files/1/0439/1269/1867/files/air_cooled_chiller_troubleshooting.pdf
• https://cdn.shopify.com/s/files/1/0431/2799/6565/files/informe_de_levantamiento_topografico_con_estacion_total.pdf
• https://cdn.shopify.com/s/files/1/0429/6910/4540/files/orchestra_video_full_hd.pdf
• https://cdn.shopify.com/s/files/1/0433/7201/9877/files/vovalonujaxogewozufuro.pdf
• https://11baff4e-9b89-481a-80c3-58fc7d2fab6a.filesusr.com/ugd/65b209_3fdf19f87b164075909c116761add47a.pdf?index=true
• https://f89c9433-75eb-4e86-90f6-61ef89f4a7e5.filesusr.com/ugd/370021_d50f821724264002ab3a7516c7df828a.pdf?index=true
• https://ee266eaf-422d-48dc-be6d-9ffd4744f7ad.filesusr.com/ugd/c57cae_8ae9156c61c94b8197a74a2b82f8d7df.pdf?index=true
• https://f43cb5c9-e0bc-4102-a3ee-9dab2e595782.filesusr.com/ugd/e2b09b_e6875234384b420daf3453445320187b.pdf?index=true
• https://cdn.shopify.com/s/files/1/0428/9835/8432/files/giratajolexodomofavewolov.pdf
• https://cdn.shopify.com/s/files/1/0432/0369/0660/files/act_sample_test_answer_key.pdf
• https://cdn.shopify.com/s/files/1/0435/4693/5447/files/nadijiwufuliwonor.pdf
• https://cdn.shopify.com/s/files/1/0482/1689/9741/files/7908302610.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• cdn.shopify.com
• 11baff4e-9b89-481a-80c3-58fc7d2fab6a.filesusr.com
• f89c9433-75eb-4e86-90f6-61ef89f4a7e5.filesusr.com
• ee266eaf-422d-48dc-be6d-9ffd4744f7ad.filesusr.com
• f43cb5c9-e0bc-4102-a3ee-9dab2e595782.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report