MALICIOUS — fa6f14_9f47d2bdb713492e8a032e643c26557a.pdf

MALICIOUS — fa6f14_9f47d2bdb713492e8a032e643c26557a.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: e8f39aa847cddbdcdc0769b48863b79328f8ed512b559a7df3634251dd30912c
• SHA-1: 7682f15effc303db99f318123cc4239ae083c830
• MD5: b0fcb58b3867285ca845c34cbefc45a3
• ssdeep: 1536:qGFGyNwGjTRW0+wwDSnJIC4vyJxRZjLA37eLY5k3qp1mQHeXKtzB0I3LEBX0i8q:TFGl2TRAwweb4aJxXjcS3DQHeczWI7ud
• TLSH: T1DF38D0F76897EE503786BF0398E120DA90429ACD60276BB499CD7E2CC57C57E7E50420
• Submitted as: fa6f14_9f47d2bdb713492e8a032e643c26557a.pdf
• File type: pdf · Size: 79224 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=saddest+love+letter+ever, https://3cdf00e2-dec7-4dc1-880c-1fb95e85de0e.filesusr.com/ugd/7cefa9_54a9966af6ef4888b4818f2860abf00c.pdf?index=true, https://e30a6315-aca8-4d11-bab7-e6cd9bd225a4.filesusr.com/ugd/ac8c68_700be36760ca420996166d4fd6789204.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=saddest+love+letter+ever
• https://3cdf00e2-dec7-4dc1-880c-1fb95e85de0e.filesusr.com/ugd/7cefa9_54a9966af6ef4888b4818f2860abf00c.pdf?index=true
• https://e30a6315-aca8-4d11-bab7-e6cd9bd225a4.filesusr.com/ugd/ac8c68_700be36760ca420996166d4fd6789204.pdf?index=true
• https://bf434c9e-4294-480f-8230-cd8c5140386f.filesusr.com/ugd/0582e0_a03541e2803f412d87a8cbd4f2847196.pdf?index=true
• https://cdn.shopify.com/s/files/1/0429/0795/9452/files/44583586198.pdf
• https://cdn.shopify.com/s/files/1/0434/2287/5797/files/daxugi.pdf
• https://98b9eee3-2883-40f5-b8bb-1ba5cc1fbbb3.filesusr.com/ugd/55f640_f51c5d3ba3144c4aa3992931933c42c4.pdf?index=true
• https://09b9ccd7-39f5-4eaa-8c3c-2d161ecd0753.filesusr.com/ugd/0c60a0_f99d7c45c0e24a06ba99650a5c64833a.pdf?index=true
• https://5f079516-acfb-4302-a06b-4adf1715e1a5.filesusr.com/ugd/a13bc2_b89523b7d1e5440bbcdf4177f2bcc0bf.pdf?index=true
• https://cdn.shopify.com/s/files/1/0431/5391/6060/files/information_geometry_of_divergence_functions.pdf
• https://cdn.shopify.com/s/files/1/0429/8748/7385/files/pekitusebefav.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• 3cdf00e2-dec7-4dc1-880c-1fb95e85de0e.filesusr.com
• e30a6315-aca8-4d11-bab7-e6cd9bd225a4.filesusr.com
• bf434c9e-4294-480f-8230-cd8c5140386f.filesusr.com
• cdn.shopify.com
• 98b9eee3-2883-40f5-b8bb-1ba5cc1fbbb3.filesusr.com
• 09b9ccd7-39f5-4eaa-8c3c-2d161ecd0753.filesusr.com
• 5f079516-acfb-4302-a06b-4adf1715e1a5.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report