MALICIOUS — 8da65f_a918376ebd76492e836dfaa1695774f2.pdf

MALICIOUS — 8da65f_a918376ebd76492e836dfaa1695774f2.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: d397db2d63b928090b7f86ec821dfdb0302b270916c3624d22ea946795d94528
SHA-1: 0b0fb95250a77a11cf043bb499761fc39027bfe8
MD5: d572e7e0b5665cc6ce301c3b281e758a
ssdeep: 768:idgGzpD8BY8y8fy04Tso2AJjdVSwnVLx8TIy1mEThochLeox0XK8BZ8RbnHOTUcA:ZGFQBRa8Trho9EoEOTJlVGFPLDd
TLSH: T1E533BFF7896AEC8D398B6743BDA705555049C78C6126F720089C372CE6BC5BCFE20A61
Submitted as: 8da65f_a918376ebd76492e836dfaa1695774f2.pdf
File type: pdf · Size: 49163 bytes
Verdict: malicious (78/100)

Detections (2 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ttraff.me/wix?keyword=ap+language+and+composition+vocabulary, https://cdn.shopify.com/s/files/1/0450/7097/5128/files/bharathiyar_kavithaigal_download.pdf, https://cdn.shopify.com/s/files/1/0433/7877/0085/files/59743863169.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

1010 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://ttraff.me/wix?keyword=ap+language+and+composition+vocabulary
https://cdn.shopify.com/s/files/1/0450/7097/5128/files/bharathiyar_kavithaigal_download.pdf
https://cdn.shopify.com/s/files/1/0433/7877/0085/files/59743863169.pdf
https://cdn.shopify.com/s/files/1/0433/5032/7455/files/17682468701.pdf
https://cdn.shopify.com/s/files/1/0438/2762/6134/files/32484063941.pdf
https://cdn.shopify.com/s/files/1/0432/8259/6004/files/2031670553.pdf
https://cdn.shopify.com/s/files/1/0432/2630/0575/files/18636836188.pdf
https://cdn.shopify.com/s/files/1/0430/8526/7097/files/34952461882.pdf
https://cdn.shopify.com/s/files/1/0437/5517/6097/files/secured_unlock_print.pdf
https://cdn.shopify.com/s/files/1/0470/9538/2174/files/new_marathi_books_free.pdf
https://cdn.shopify.com/s/files/1/0440/7135/4533/files/63877470391.pdf
https://cdn.shopify.com/s/files/1/0429/9948/0473/files/zufegonotikilesoxikukazev.pdf
https://cdn.shopify.com/s/files/1/0435/7645/9422/files/dukezazuvoniwowobo.pdf
https://cdn.shopify.com/s/files/1/0437/1673/9222/files/bloomberg_new_energy_finance_storage_report.pdf
https://cdn.shopify.com/s/files/1/0465/3291/9446/files/port_mansfield_weather_report.pdf
https://cdn.shopify.com/s/files/1/0432/6732/6110/files/bumasonix.pdf
https://cdn.shopify.com/s/files/1/0433/3905/5253/files/kai_access_apk_terbaru.pdf
https://cdn.shopify.com/s/files/1/0454/3024/3484/files/budozilirozoluvitekinawe.pdf
https://cdn.shopify.com/s/files/1/0429/3266/6524/files/black_s_law_dictionary_4th_edition_free_download.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ttraff.me
cdn.shopify.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report