MALICIOUS — 312e0e_d1e3230bcb7f48b891a517e7966623f2.pdf

MALICIOUS — 312e0e_d1e3230bcb7f48b891a517e7966623f2.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: ce3a241588cd103db90b0c71eb1369ab9c73137a054b9597f8a1b0674856ab47
• SHA-1: fdb9c8a7629bf44874830a5027266fd2575e7577
• MD5: aea3ec93015c758cee4bd1a399a69d64
• ssdeep: 768:MgGzpDFL8RWSQQJpSQycmRpSh/2+it/D+11kcec+zY:JGFh+ycmiN2+E/skcec+zY
• TLSH: T11F2F8EF35457ED8C7A8B5B036DA6111DA049C3CE6227A66041D83B2CD4BC7FEAF00960
• Submitted as: 312e0e_d1e3230bcb7f48b891a517e7966623f2.pdf
• File type: pdf · Size: 35724 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=splatoon+discord+server, https://91d86810-6c0e-4bd8-92a7-bc87c2d1c2d3.filesusr.com/ugd/65b209_4b74c10e00674ab9af89e58d202e72d0.pdf?index=true, https://21ddfc12-71ec-4518-82a9-d968c308200e.filesusr.com/ugd/7be1cd_83b21b1ce28549f5beda9630137e95d2.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=splatoon+discord+server
• https://91d86810-6c0e-4bd8-92a7-bc87c2d1c2d3.filesusr.com/ugd/65b209_4b74c10e00674ab9af89e58d202e72d0.pdf?index=true
• https://21ddfc12-71ec-4518-82a9-d968c308200e.filesusr.com/ugd/7be1cd_83b21b1ce28549f5beda9630137e95d2.pdf?index=true
• https://53f3a2f0-dd75-466f-a78e-e155862cd52d.filesusr.com/ugd/f08e01_328b91c2448e4abc88b32fcbd6221717.pdf?index=true
• https://4b48d582-fe74-464f-b53b-aed3023fa06c.filesusr.com/ugd/8e6e76_9b176b9ce6e44bcb8925d9f1e5271944.pdf?index=true
• https://a0265a74-d679-40c0-911f-4c7722f8432b.filesusr.com/ugd/682d1c_c0eb4190d7814093b444c277ec12abe5.pdf?index=true
• https://5e53241b-1b6a-4b73-a917-ed2431a5ade3.filesusr.com/ugd/baef12_cf7cc6d144b0493bbaf24b9318dd7633.pdf?index=true
• https://c55a8e8e-f659-4972-acee-02f43e91aa68.filesusr.com/ugd/0b46e6_31a11b04b5b647299fc54ae7bb2987a3.pdf?index=true
• https://bbf9c982-ebda-41db-aef5-ae88fc670586.filesusr.com/ugd/80bfa9_0381d065b297455582a0b5057be5577d.pdf?index=true
• https://cdn.shopify.com/s/files/1/0435/1007/1460/files/rxprep_2018_free_download.pdf
• https://cdn.shopify.com/s/files/1/0430/9565/4564/files/25362405866.pdf
• https://cdn.shopify.com/s/files/1/0434/2562/8316/files/sinusitis_maxillaris_adalah.pdf
• https://cdn.shopify.com/s/files/1/0436/8538/0246/files/kugemipu.pdf
• https://f39400fb-7b5c-4f64-82dc-2781857dc4eb.filesusr.com/ugd/48bf55_a02d4bc19baf49ccb0518a4cc2b09942.pdf?index=true
• https://c09db502-76bc-473d-89dc-009c7a45c3a1.filesusr.com/ugd/f08e01_00502e60e78949c68f061a52a6eec4be.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• 91d86810-6c0e-4bd8-92a7-bc87c2d1c2d3.filesusr.com
• 21ddfc12-71ec-4518-82a9-d968c308200e.filesusr.com
• 53f3a2f0-dd75-466f-a78e-e155862cd52d.filesusr.com
• 4b48d582-fe74-464f-b53b-aed3023fa06c.filesusr.com
• a0265a74-d679-40c0-911f-4c7722f8432b.filesusr.com
• 5e53241b-1b6a-4b73-a917-ed2431a5ade3.filesusr.com
• c55a8e8e-f659-4972-acee-02f43e91aa68.filesusr.com
• bbf9c982-ebda-41db-aef5-ae88fc670586.filesusr.com
• cdn.shopify.com
• f39400fb-7b5c-4f64-82dc-2781857dc4eb.filesusr.com
• c09db502-76bc-473d-89dc-009c7a45c3a1.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report