MALICIOUS — a01749_3832c74c0ab64cb2b7cc74be43df9fbe.pdf

MALICIOUS — a01749_3832c74c0ab64cb2b7cc74be43df9fbe.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: eb1c469b6654eba0c9e3df958e3613b7a2d0306bada225e13ef6cc99cf327f7d
• SHA-1: 22dacd7e342fcd0db32f6d949c686e29d0a9502b
• MD5: 989dac292e4514a352a764589dab7504
• ssdeep: 768:4bgGzpDC1q2p07/FTIuiJD8M+yiFrK9qVyYV12G3Wc0+HjE:ZGFuM2wI2y2+9qVyYVcD+HjE
• TLSH: T1E4319EF31497ED8C7E9B9B039CE6215A6084D68D6132A37154DC3B2CD4BC27CAF55860
• Submitted as: a01749_3832c74c0ab64cb2b7cc74be43df9fbe.pdf
• File type: pdf · Size: 40264 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=gymboree+class+schedule+basking+ridge+nj, https://ce0d518b-5b54-47aa-b2ed-4d9909573c92.filesusr.com/ugd/811c4f_fc3e422a4b194f98b61b54fc51acf8e0.pdf?index=true, https://de31a46b-faee-4a6e-aa42-500131a8d249.filesusr.com/ugd/8b9728_e69d083f3a4045a3a517a183283d591c.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=gymboree+class+schedule+basking+ridge+nj
• https://ce0d518b-5b54-47aa-b2ed-4d9909573c92.filesusr.com/ugd/811c4f_fc3e422a4b194f98b61b54fc51acf8e0.pdf?index=true
• https://de31a46b-faee-4a6e-aa42-500131a8d249.filesusr.com/ugd/8b9728_e69d083f3a4045a3a517a183283d591c.pdf?index=true
• https://98924b8b-1355-48b6-9292-2e1ba912f7da.filesusr.com/ugd/46a5ae_f6363627224d424995e092b6b162bbca.pdf?index=true
• https://b15e4143-992f-48e6-a4dd-cf4779c77bfb.filesusr.com/ugd/760a88_d453961b477a4e3386d35fc69af71de6.pdf?index=true
• https://483b2783-0303-4fc0-8b89-3a70a5ff41e9.filesusr.com/ugd/f1780b_fe01a5ebee344fb584cc87ca3b6ab59a.pdf?index=true
• https://58247d53-78e4-4925-83b8-10726e14f4c3.filesusr.com/ugd/185811_1774adfae8c142479cd0b7f02720ee87.pdf?index=true
• https://8fa4322d-c5fd-4177-b256-d2a62d52d857.filesusr.com/ugd/717a42_f84f978ac67044bf9654eba9299669d9.pdf?index=true
• https://522569fc-ac5c-4132-8f7a-df01ffefae88.filesusr.com/ugd/a32c20_9427053596d64d4a9cc6c5561889056b.pdf?index=true
• https://cdn.shopify.com/s/files/1/0437/9898/6909/files/english_synonyms_and_antonyms.pdf
• https://cdn.shopify.com/s/files/1/0430/2657/9610/files/uae_calendar_2020_with_holidays.pdf
• https://cdn.shopify.com/s/files/1/0433/4557/6088/files/soreroziputijitek.pdf
• https://cdn.shopify.com/s/files/1/0439/8769/7822/files/tatupupigurazogubelaseves.pdf
• https://b9203928-414d-4d0d-951a-c00ee7f71f71.filesusr.com/ugd/0cd019_0dd4664f1c3f486bb90cadc6c612074d.pdf?index=true
• https://e0d04271-313c-4ee9-8581-bc499244d56b.filesusr.com/ugd/7be1cd_d6a6083966ef4c779b1e80f998737296.pdf?index=true
• https://55e62cc8-ede4-455f-89ab-23d5f1f7853d.filesusr.com/ugd/a4e402_924f40da6894470d8a3c435fafe833cb.pdf?index=true
• https://a9a0fef4-7c76-43eb-8d3d-d6bb01aaf119.filesusr.com/ugd/f35da0_e52f28de724d4c81a993aa2068fa48f2.pdf?index=true
• https://77c71392-2c10-4b7c-99af-1f568274ca15.filesusr.com/ugd/405339_3327d03531d4448699d4989261cf27d0.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• ce0d518b-5b54-47aa-b2ed-4d9909573c92.filesusr.com
• de31a46b-faee-4a6e-aa42-500131a8d249.filesusr.com
• 98924b8b-1355-48b6-9292-2e1ba912f7da.filesusr.com
• b15e4143-992f-48e6-a4dd-cf4779c77bfb.filesusr.com
• 483b2783-0303-4fc0-8b89-3a70a5ff41e9.filesusr.com
• 58247d53-78e4-4925-83b8-10726e14f4c3.filesusr.com
• 8fa4322d-c5fd-4177-b256-d2a62d52d857.filesusr.com
• 522569fc-ac5c-4132-8f7a-df01ffefae88.filesusr.com
• cdn.shopify.com
• b9203928-414d-4d0d-951a-c00ee7f71f71.filesusr.com
• e0d04271-313c-4ee9-8581-bc499244d56b.filesusr.com
• 55e62cc8-ede4-455f-89ab-23d5f1f7853d.filesusr.com
• a9a0fef4-7c76-43eb-8d3d-d6bb01aaf119.filesusr.com
• 77c71392-2c10-4b7c-99af-1f568274ca15.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report