MALICIOUS — dc8a8e_5f3b6f216a884b0ca6a2acff190d9713.pdf

MALICIOUS — dc8a8e_5f3b6f216a884b0ca6a2acff190d9713.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: f0031ab53075acb33999b9e356c6bb347aabee7f345f3c0b4918f2751e8b8a7b
• SHA-1: fcd4b34a635ba8fbce6483f40e934ab63d6853bd
• MD5: 786db55fbbd9521cf72f8ff6e9953445
• ssdeep: 768:OgGzpDLguPWPnDaoc9c9Q7aCdL/LO2eqdwLXEFd9AFui1Joeg3A:rGF/wkG2eqdcU1ni1Joe8A
• TLSH: T156307DF764A7ED8C7A8A9703ADEB110E2045D7886133A76055DC3B2CD5BC6BDBE10860
• Submitted as: dc8a8e_5f3b6f216a884b0ca6a2acff190d9713.pdf
• File type: pdf · Size: 36862 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.PDF.Agent.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.PDF.Agent.gen (rule HEUR:Trojan.PDF.Agent.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=magical+treatise+of+solomon+pdf+download, https://cdn.shopify.com/s/files/1/0435/7118/3775/files/xosutuvonowidotosemenemaz.pdf, https://cdn.shopify.com/s/files/1/0434/2412/0984/files/465729625.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=magical+treatise+of+solomon+pdf+download
• https://cdn.shopify.com/s/files/1/0435/7118/3775/files/xosutuvonowidotosemenemaz.pdf
• https://cdn.shopify.com/s/files/1/0434/2412/0984/files/465729625.pdf
• https://cdn.shopify.com/s/files/1/0432/0182/2875/files/buddhist_meditation_techniques.pdf
• https://cdn.shopify.com/s/files/1/0431/2222/9397/files/jalovidiw.pdf
• https://cdn.shopify.com/s/files/1/0432/4032/5282/files/definition_of_economics_by_ten_different_authors.pdf
• https://cdn.shopify.com/s/files/1/0427/7967/2735/files/56645499609.pdf
• https://cdn.shopify.com/s/files/1/0430/9345/9093/files/faxifonediwuloredef.pdf
• https://cdn.shopify.com/s/files/1/0431/2665/3090/files/rarojanafejilarufipimala.pdf
• https://7ef35833-5921-40f9-8e34-a34287512b48.filesusr.com/ugd/7be1cd_3cedd63c06b84e12bc15c0a8793e177f.pdf?index=true
• https://ba5d88cf-ad0e-48d5-9810-73f9a8c3126f.filesusr.com/ugd/035627_0f8b0dc46a894af08f69065340361c9a.pdf?index=true
• https://1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com/ugd/227d0f_f21861fd7cd84aa7b9b29a8b14cd40ef.pdf?index=true
• https://d91457d6-a929-4d89-aced-7f5f0d012ecb.filesusr.com/ugd/54dfea_9b22e54e9fa043f4a541d03b7f9a0a86.pdf?index=true
• https://cdn.shopify.com/s/files/1/0433/4570/7166/files/daranakakulipuruzirudiwe.pdf
• https://cdn.shopify.com/s/files/1/0433/6277/9295/files/example_lab_report_chemistry_titration.pdf
• https://cdn.shopify.com/s/files/1/0437/4947/4453/files/52009081756.pdf
• https://cdn.shopify.com/s/files/1/0463/4689/5517/files/christmas_party_invitation_card_template.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• cdn.shopify.com
• 7ef35833-5921-40f9-8e34-a34287512b48.filesusr.com
• ba5d88cf-ad0e-48d5-9810-73f9a8c3126f.filesusr.com
• 1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com
• d91457d6-a929-4d89-aced-7f5f0d012ecb.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report