MALICIOUS — bdc04d_dc53d7475a874a76a2fc5578ad7f819d.pdf

MALICIOUS — bdc04d_dc53d7475a874a76a2fc5578ad7f819d.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: e9b62c81600363674a233613b1d8ccee1f2e0d764d1d3dc956810cdb100417db
• SHA-1: 04b9149105a08b8ab4ef51bde4627afaa5b504f5
• MD5: 69f2e858e620aaf263a60df5edc0be99
• ssdeep: 1536:ZGFu4YHNS+mNsvPX7fYTV6wKkKUW7bqW9Y4S3vfy:sFu1Hk+mNsvPLwp6/oWvk4S3i
• TLSH: T1B333AFF35067DDDCBA87AF436CB71165618AD7493033AB701989762CC0BC6BDAE00A60
• Submitted as: bdc04d_dc53d7475a874a76a2fc5578ad7f819d.pdf
• File type: pdf · Size: 51300 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=instalike+mod+apk, https://aa8a0926-e23e-42e0-9dee-49df6e1056dc.filesusr.com/ugd/067ecb_e67ce1639fc5451fa5cbcb5e004275c8.pdf?index=true, https://e73380fc-a9c5-47af-9ea7-5d56044df508.filesusr.com/ugd/b361c6_799749fd17a6499a890a5dae2ac3643e.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=instalike+mod+apk
• https://aa8a0926-e23e-42e0-9dee-49df6e1056dc.filesusr.com/ugd/067ecb_e67ce1639fc5451fa5cbcb5e004275c8.pdf?index=true
• https://e73380fc-a9c5-47af-9ea7-5d56044df508.filesusr.com/ugd/b361c6_799749fd17a6499a890a5dae2ac3643e.pdf?index=true
• https://13bfa6d7-f724-44d4-b207-b7c8035ef9fc.filesusr.com/ugd/3225da_db7c5de134324905a79f790217a9dda1.pdf?index=true
• https://47a3c296-6534-4f32-bf68-ad73ae1384db.filesusr.com/ugd/e643da_786edf3f492e4ad6919572f8a770aa01.pdf?index=true
• https://1ea7369a-4a20-4b89-ae39-b1ff41a379f3.filesusr.com/ugd/a32c20_641e3279312d4c1d92b09d75149e33f0.pdf?index=true
• https://1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com/ugd/227d0f_f21861fd7cd84aa7b9b29a8b14cd40ef.pdf?index=true
• https://f625eb5e-16d2-4e2a-b12d-bb625a7b2aa5.filesusr.com/ugd/469aea_e7f7de22674943b587af2cda7f1a6332.pdf?index=true
• https://1a4bc26b-6346-40b5-9423-01b1b9c9f91f.filesusr.com/ugd/3225da_8ed3b1f0731b4e88a956b1eb5bce429c.pdf?index=true
• https://b5602a9f-7d32-4e80-8f2d-7f80397e5b17.filesusr.com/ugd/36d413_01bc2b83a23e4587ac4625b39a0b7555.pdf?index=true
• https://b54e0a24-420c-4d6f-93c4-82f305a601d6.filesusr.com/ugd/12dc78_209a7076ef704b3ea32884e8f73b57d4.pdf?index=true
• https://71075007-e386-4398-9bed-1f48bd948b69.filesusr.com/ugd/9d7ad9_6fadd8269c3442a986589fe404e3f290.pdf?index=true
• https://ceb5b5a1-9825-4aae-860a-2ecd976478be.filesusr.com/ugd/d43733_be733a80749449f3a5ccb219030ba6ae.pdf?index=true
• https://cdn.shopify.com/s/files/1/0434/5842/9078/files/typing_agent_cheats.pdf
• https://cdn.shopify.com/s/files/1/0433/7677/1224/files/ben_10_protector_of_earth_emuparadise_apk.pdf
• https://cdn.shopify.com/s/files/1/0438/2700/3549/files/lisomadisizaravagowofibed.pdf
• https://cdn.shopify.com/s/files/1/0438/7491/0376/files/teviput.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• aa8a0926-e23e-42e0-9dee-49df6e1056dc.filesusr.com
• e73380fc-a9c5-47af-9ea7-5d56044df508.filesusr.com
• 13bfa6d7-f724-44d4-b207-b7c8035ef9fc.filesusr.com
• 47a3c296-6534-4f32-bf68-ad73ae1384db.filesusr.com
• 1ea7369a-4a20-4b89-ae39-b1ff41a379f3.filesusr.com
• 1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com
• f625eb5e-16d2-4e2a-b12d-bb625a7b2aa5.filesusr.com
• 1a4bc26b-6346-40b5-9423-01b1b9c9f91f.filesusr.com
• b5602a9f-7d32-4e80-8f2d-7f80397e5b17.filesusr.com
• b54e0a24-420c-4d6f-93c4-82f305a601d6.filesusr.com
• 71075007-e386-4398-9bed-1f48bd948b69.filesusr.com
• ceb5b5a1-9825-4aae-860a-2ecd976478be.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report