MALICIOUS — fb83f1_be0688c250cc423b840edd15db267ec4.pdf

MALICIOUS — fb83f1_be0688c250cc423b840edd15db267ec4.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: d16b653a43e0926b7282568214336ec41509c15e46e9c9eba5429bcbe2d43704
• SHA-1: c22475049352a736c7466678637b91d9be48ae4e
• MD5: 1c72485c12908aaf3193e61ad9f044fd
• ssdeep: 768:QgGzpDy9++zwW/70pv6OF2r9R0aoUJub+DI4Dex7DZqDRB83CaPMp5K3O:9GF+9qpvW98Iub+DIPJqDna0p5K3O
• TLSH: T10D33AEF31097DC8C7AC7DF036AA6255DA18AD7886132A66014D8376CD57C2FCBE62630
• Submitted as: fb83f1_be0688c250cc423b840edd15db267ec4.pdf
• File type: pdf · Size: 50620 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=jailbreak+wii+u+5.5.3, https://6392b295-f72b-4afa-b427-376d5b4f1f8c.filesusr.com/ugd/9cfd0a_5d502d78fe854c0ea7893609eb1c90c7.pdf?index=true, https://b2aac97f-e45e-4525-9080-a7ab744c4fda.filesusr.com/ugd/1813b3_43fd149ff28f4c3b98481132cb64cb2b.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=jailbreak+wii+u+5.5.3
• https://6392b295-f72b-4afa-b427-376d5b4f1f8c.filesusr.com/ugd/9cfd0a_5d502d78fe854c0ea7893609eb1c90c7.pdf?index=true
• https://b2aac97f-e45e-4525-9080-a7ab744c4fda.filesusr.com/ugd/1813b3_43fd149ff28f4c3b98481132cb64cb2b.pdf?index=true
• https://6f2a3e62-8287-42b6-809b-c84334d9dc61.filesusr.com/ugd/35c6e2_2059b52814764830a4fa6d03ab5a600d.pdf?index=true
• https://7b262e93-960c-4894-8147-7fe65032a1b7.filesusr.com/ugd/c450b2_d3c143a10c0f46fa9d02efe6dfcad8ad.pdf?index=true
• https://70985520-c65f-4a63-b6a4-156d8faf0389.filesusr.com/ugd/bb05c1_1f17d718837d4d51bb1efd015a7852c1.pdf?index=true
• https://46207ac1-b16d-4554-86c3-6749990f7cba.filesusr.com/ugd/d6b5da_f79489a39ec341d29f3dd29aa9a1b5dd.pdf?index=true
• https://cdn.shopify.com/s/files/1/0430/7124/2389/files/nomagajujakixuwaxiro.pdf
• https://cdn.shopify.com/s/files/1/0437/0972/6874/files/batun.pdf
• https://cdn.shopify.com/s/files/1/0439/1449/4107/files/42133828164.pdf
• https://cdn.shopify.com/s/files/1/0446/6864/9625/files/aldehydes_and_ketones_ncert_solutions.pdf
• https://cdn.shopify.com/s/files/1/0433/7657/4620/files/rijuzebenulokagaguwajise.pdf
• https://9dcb4fdb-8b56-468e-a323-abaeafbddfc5.filesusr.com/ugd/5bf82b_3f79d45ab1a040e8af5d3072ee883eec.pdf?index=true
• https://3c415888-bbd5-4b88-b592-771c760fcc6b.filesusr.com/ugd/268ab1_ea176800ef37441db79795c4b9b915e1.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• 6392b295-f72b-4afa-b427-376d5b4f1f8c.filesusr.com
• b2aac97f-e45e-4525-9080-a7ab744c4fda.filesusr.com
• 6f2a3e62-8287-42b6-809b-c84334d9dc61.filesusr.com
• 7b262e93-960c-4894-8147-7fe65032a1b7.filesusr.com
• 70985520-c65f-4a63-b6a4-156d8faf0389.filesusr.com
• 46207ac1-b16d-4554-86c3-6749990f7cba.filesusr.com
• cdn.shopify.com
• 9dcb4fdb-8b56-468e-a323-abaeafbddfc5.filesusr.com
• 3c415888-bbd5-4b88-b592-771c760fcc6b.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report