MALICIOUS — f08e01_7d7369e8a8764344adcd0744dc8878cd.pdf

MALICIOUS — f08e01_7d7369e8a8764344adcd0744dc8878cd.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: cf4236d904951c1657c56fc74445c769f3450fe96be2aa4c644487b5363cbeab
• SHA-1: a1b41ba8eade17c1873120e922d515cd008d0ad2
• MD5: 1d79892aa7957e9312238bd6df5917dd
• ssdeep: 768:cgGzpDc7V3ansk7mE0rR0zIVeP9V8bE5ITGSBcKprapGstSOs:5GFo7iye84lV8bEYGWOpGstSOs
• TLSH: T10332AEF31097ED8C779A7B036EDB10697146C58DA1229AA0148C7B6CC4BC6FDAF10B61
• Submitted as: f08e01_7d7369e8a8764344adcd0744dc8878cd.pdf
• File type: pdf · Size: 46356 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=middle+ages+crime+and+punishment+ks2, https://a0ccc12d-047c-4706-aaf1-b3e77c3bd8b9.filesusr.com/ugd/610d21_75961537611745f0987d67db48c0cda3.pdf?index=true, https://26a1bf29-e367-4a0f-92a8-772d946bd0da.filesusr.com/ugd/4329d7_c67d8ccbfa9246ffbc237411fb4db236.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=middle+ages+crime+and+punishment+ks2
• https://a0ccc12d-047c-4706-aaf1-b3e77c3bd8b9.filesusr.com/ugd/610d21_75961537611745f0987d67db48c0cda3.pdf?index=true
• https://26a1bf29-e367-4a0f-92a8-772d946bd0da.filesusr.com/ugd/4329d7_c67d8ccbfa9246ffbc237411fb4db236.pdf?index=true
• https://ba8d818c-dcdc-4476-9845-37f10e7b1367.filesusr.com/ugd/dcf9ad_39142074fab44e5197f14f79ca6f1c84.pdf?index=true
• https://509fd86f-60b0-4fb3-95ae-86ff09cb6fe1.filesusr.com/ugd/33ab24_f166369786474aaaa5603a92914f16e6.pdf?index=true
• https://7ccf4aa6-626f-414f-b866-4df257487e46.filesusr.com/ugd/eb6612_6fea4f336c444179bf97dd8ad3c7ea3b.pdf?index=true
• https://809a7bcf-18c5-4cab-9c49-0c413a0364f1.filesusr.com/ugd/69695d_4f91dc956c5e4d968bdb1fed4787ccca.pdf?index=true
• https://13fcb855-10df-4961-9a59-98d300588de4.filesusr.com/ugd/54dfea_f1c93ebb21b74d4b8cf6b23bd1390bf3.pdf?index=true
• https://d45c54e3-11b0-4e58-8f13-2b1adf1c57fa.filesusr.com/ugd/740d8c_fec13985938543e1a22e67f49b44b0c5.pdf?index=true
• https://fe9376ad-ae9f-47f6-a1d4-e7eb3a72cb48.filesusr.com/ugd/4329d7_9e8048efc06042c1b2e4ab6c9903867c.pdf?index=true
• https://40429b4b-d855-4b32-aa6b-cea0adbafd6d.filesusr.com/ugd/5bb01c_536037b408f84525b7b23cb12ad997e0.pdf?index=true
• https://19867a25-dc77-425f-97a9-ab14bda4a674.filesusr.com/ugd/9df9d6_d200703251a848a6b97a32655d8de01f.pdf?index=true
• https://07ed169d-f166-451b-86fe-9bac6989c938.filesusr.com/ugd/54dfea_93b57c22c4ac49b498c384fa1caed2d0.pdf?index=true
• https://8cf9f28e-b1c2-47d0-86c8-09043c81b9eb.filesusr.com/ugd/359e64_3de3f0c13035479da6faa3c442959f5f.pdf?index=true
• https://3e2af481-0ae0-4842-a3fa-1b07beb6c7c8.filesusr.com/ugd/d6af85_95d4f4135b9040b6bd443daf869c1b0f.pdf?index=true
• https://a1a19fd9-2239-497d-906b-80bc729ff515.filesusr.com/ugd/d6af85_e92c0784c6224671975fca7dc70e5750.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• a0ccc12d-047c-4706-aaf1-b3e77c3bd8b9.filesusr.com
• 26a1bf29-e367-4a0f-92a8-772d946bd0da.filesusr.com
• ba8d818c-dcdc-4476-9845-37f10e7b1367.filesusr.com
• 509fd86f-60b0-4fb3-95ae-86ff09cb6fe1.filesusr.com
• 7ccf4aa6-626f-414f-b866-4df257487e46.filesusr.com
• 809a7bcf-18c5-4cab-9c49-0c413a0364f1.filesusr.com
• 13fcb855-10df-4961-9a59-98d300588de4.filesusr.com
• d45c54e3-11b0-4e58-8f13-2b1adf1c57fa.filesusr.com
• fe9376ad-ae9f-47f6-a1d4-e7eb3a72cb48.filesusr.com
• 40429b4b-d855-4b32-aa6b-cea0adbafd6d.filesusr.com
• 19867a25-dc77-425f-97a9-ab14bda4a674.filesusr.com
• 07ed169d-f166-451b-86fe-9bac6989c938.filesusr.com
• 8cf9f28e-b1c2-47d0-86c8-09043c81b9eb.filesusr.com
• 3e2af481-0ae0-4842-a3fa-1b07beb6c7c8.filesusr.com
• a1a19fd9-2239-497d-906b-80bc729ff515.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report