MALICIOUS — 9cfd0a_40b54cf3482047cc97e8bfcca805dc67.pdf
MALICIOUS — 9cfd0a_40b54cf3482047cc97e8bfcca805dc67.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
dd556993c562e901902003671cf62f5f298335e48aa8a4ac87616cb648a6d0cd - SHA-1:
27877072460d30b6cdd7cef25da7127197f903d3 - MD5:
23a6828d2d629ca2ee04bdc1f7940adc - ssdeep:
768:NgGzpDb7ews19mVYfESvr2wmYilsbQWzQ03m/gg:uGFPlsvuY82W/gg - TLSH:
T1E632AFF350A7ED4D7687AB03A9EA15186089D78E2073E7A445C8776CC47C2BEBE20D50 - Submitted as: 9cfd0a_40b54cf3482047cc97e8bfcca805dc67.pdf
- File type: pdf · Size: 46719 bytes
- Verdict: malicious (88/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
Why this verdict
The malicious score of 88/100 is the fusion of 6 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule
UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ttraff.cc/wix?keyword=como+ser+buen+lider+cristiano, https://cdn.shopify.com/s/files/1/0440/8072/6168/files/60385916363.pdf, https://cdn.shopify.com/s/files/1/0430/0773/8019/files/kojewizulob.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.cc/wix?keyword=como+ser+buen+lider+cristiano
- https://cdn.shopify.com/s/files/1/0440/8072/6168/files/60385916363.pdf
- https://cdn.shopify.com/s/files/1/0430/0773/8019/files/kojewizulob.pdf
- https://cdn.shopify.com/s/files/1/0428/5346/6271/files/all_naruto_openings.pdf
- https://cdn.shopify.com/s/files/1/0434/3077/2892/files/jaresobilukotiwa.pdf
- https://6f2a3e62-8287-42b6-809b-c84334d9dc61.filesusr.com/ugd/35c6e2_2059b52814764830a4fa6d03ab5a600d.pdf?index=true
- https://7f20416c-1843-43c7-b4d6-e11739f07134.filesusr.com/ugd/417718_25fb8b531b054f8e99473e00da1a0b32.pdf?index=true
- https://20b44dae-efa8-4908-84df-f6bc35aeb94e.filesusr.com/ugd/f1780b_8b623f9a634c4eec8c76f8f863d2aa11.pdf?index=true
- https://cdn.shopify.com/s/files/1/0432/2469/4942/files/gosibiziretirup.pdf
- https://cdn.shopify.com/s/files/1/0438/3450/7426/files/46897508002.pdf
- https://9321d2e7-76bb-4276-ae0b-026ccca775c0.filesusr.com/ugd/7d1dc9_44cf4ff8df104ebcab7a2fa9e459c68f.pdf?index=true
- https://3269139c-75f9-4785-96c6-75e9e9564169.filesusr.com/ugd/d4a9d6_2dce65f5eb194683bc3eb4f15ce33864.pdf?index=true
- https://42e3296c-fdfe-4846-a38d-120d79a9f8f7.filesusr.com/ugd/ac8c68_f48d0b73af824134bc8ff9d2c00f263d.pdf?index=true
- https://ec8c1ecb-4c87-4807-b1dd-65a90b869df1.filesusr.com/ugd/89064d_10709abdd53f4e83b4b3013590ee4609.pdf?index=true
- https://468a6eb5-8586-4a86-b60c-6bee64e84b06.filesusr.com/ugd/610d21_30f0fd092b594a128a76266673c7e74e.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ttraff.cc
- cdn.shopify.com
- 6f2a3e62-8287-42b6-809b-c84334d9dc61.filesusr.com
- 7f20416c-1843-43c7-b4d6-e11739f07134.filesusr.com
- 20b44dae-efa8-4908-84df-f6bc35aeb94e.filesusr.com
- 9321d2e7-76bb-4276-ae0b-026ccca775c0.filesusr.com
- 3269139c-75f9-4785-96c6-75e9e9564169.filesusr.com
- 42e3296c-fdfe-4846-a38d-120d79a9f8f7.filesusr.com
- ec8c1ecb-4c87-4807-b1dd-65a90b869df1.filesusr.com
- 468a6eb5-8586-4a86-b60c-6bee64e84b06.filesusr.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report