MALICIOUS — f2c1dc_004f7327e897450f979ad7b5548848df.pdf

MALICIOUS — f2c1dc_004f7327e897450f979ad7b5548848df.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: ef4ddbd3eeb1567be4a9949d2ee47814115365055b4259fa423fe01c0162691d
• SHA-1: d6033fbc597db5755e85d68ec1c524e460d31340
• MD5: 14038ded3c12c441d8510acc1cd0bce8
• ssdeep: 768:AgGzpD/XacDQ9I18RB4D583zcYEi9vxwx8U91k73PY+6qkAdNmC2QsOzM:NGF7Ji68UbkjPY+6pAdNmv4zM
• TLSH: T1F8329DF30057EC4C77CB5B436EAB006D6049DA8E7032E6A05598376CD4BC6FDAE50A62
• Submitted as: f2c1dc_004f7327e897450f979ad7b5548848df.pdf
• File type: pdf · Size: 45604 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=aim+trainer+unblocked+66+ez, https://cdn.shopify.com/s/files/1/0432/5012/2916/files/sanoraxuj.pdf, https://cdn.shopify.com/s/files/1/0429/3689/3599/files/nivoberexepitifovawezidub.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=aim+trainer+unblocked+66+ez
• https://cdn.shopify.com/s/files/1/0432/5012/2916/files/sanoraxuj.pdf
• https://cdn.shopify.com/s/files/1/0429/3689/3599/files/nivoberexepitifovawezidub.pdf
• https://cdn.shopify.com/s/files/1/0434/2022/1607/files/68358665252.pdf
• https://cdn.shopify.com/s/files/1/0428/0477/3031/files/jazogirug.pdf
• https://cdn.shopify.com/s/files/1/0431/6761/3087/files/effects_of_globalization_on_developing_countries.pdf
• https://37bb914b-15a9-4444-b1c9-280bb003343f.filesusr.com/ugd/a8ca0f_338b99d356d94b6181d3dad032ed7c8d.pdf?index=true
• https://d006ae5e-4e01-4a56-8e15-9be73e9866e4.filesusr.com/ugd/575363_8d6625bedce64de5946e52d7711c3187.pdf?index=true
• https://cdn.shopify.com/s/files/1/0436/7309/2246/files/takozagetiziwax.pdf
• https://cdn.shopify.com/s/files/1/0433/0677/8777/files/mumopujoxab.pdf
• https://cdn.shopify.com/s/files/1/0430/1216/1685/files/1655265721.pdf
• https://cdn.shopify.com/s/files/1/0430/8434/9591/files/cisco_3750_switch_ios_for_gns3.pdf
• https://cdn.shopify.com/s/files/1/0432/5575/9011/files/71529323708.pdf
• https://cdn.shopify.com/s/files/1/0433/0491/1006/files/guzajezesu.pdf
• https://cdn.shopify.com/s/files/1/0435/1547/8176/files/niviwevatezija.pdf
• https://cdn.shopify.com/s/files/1/0433/0687/7080/files/dedapefe.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• cdn.shopify.com
• 37bb914b-15a9-4444-b1c9-280bb003343f.filesusr.com
• d006ae5e-4e01-4a56-8e15-9be73e9866e4.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report