MALICIOUS — 269bb8_5125f50bdfc74ddd9a0142e8a94e337e.pdf

MALICIOUS — 269bb8_5125f50bdfc74ddd9a0142e8a94e337e.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: f0c9efdfe3b41649d4a5fced0ca483055c70d4ebda1e905c2472f061bc9e8917
• SHA-1: 5b0d369e9fec780bead182cf23f9e8708f3eaf72
• MD5: 662324f2526614ea25eb4e02d93002ea
• ssdeep: 1536:fGFt2qCbHJcMIPmxk5bkYnRWpWUxcCDOf3dsZlfyYV6iF6JGkp+zSv3:OFtRCrWPmAbkYnwp95Tlt6Ebkp+zs
• TLSH: T11139E0F390CAEE8D6B876F177DE204556155D3CDA232EA6029C977ACC0787BC6D10A20
• Submitted as: 269bb8_5125f50bdfc74ddd9a0142e8a94e337e.pdf
• File type: pdf · Size: 86163 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=sample+letter+to+withdraw+immigration+application, https://cdn.shopify.com/s/files/1/0431/3215/8116/files/allied_telesis_switch_user_guide.pdf, https://cdn.shopify.com/s/files/1/0432/0870/4164/files/category_theory_for_programmers_bartosz_milewski.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=sample+letter+to+withdraw+immigration+application
• https://cdn.shopify.com/s/files/1/0431/3215/8116/files/allied_telesis_switch_user_guide.pdf
• https://cdn.shopify.com/s/files/1/0432/0870/4164/files/category_theory_for_programmers_bartosz_milewski.pdf
• https://cdn.shopify.com/s/files/1/0440/8098/8325/files/ong_bak_4.pdf
• https://cdn.shopify.com/s/files/1/0432/7469/8902/files/sewijifikakun.pdf
• https://cdn.shopify.com/s/files/1/0431/1593/7948/files/bioelectric_potential.pdf
• https://cdn.shopify.com/s/files/1/0433/8325/9285/files/peter_atkins.pdf
• https://cdn.shopify.com/s/files/1/0433/5498/0505/files/40985758549.pdf
• https://cdn.shopify.com/s/files/1/0430/1006/4537/files/44366281650.pdf
• https://cdn.shopify.com/s/files/1/0431/9959/4656/files/human_body_parts_chart.pdf
• https://cdn.shopify.com/s/files/1/0431/8032/7076/files/don_t_whack_your_boss_with_superpowers.pdf
• https://d152ebec-5c1d-452d-9555-58fb9172dd55.filesusr.com/ugd/0582e0_5e143bdfcf0e4ed8bdf8c9d70f416f1a.pdf?index=true
• https://f915a33e-f807-11ea-a328-fc4dd43d38a6.filesusr.com/ugd/9ef0c3_4541a83cf6a3405ca5ea10b951df6fe5.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• cdn.shopify.com
• d152ebec-5c1d-452d-9555-58fb9172dd55.filesusr.com
• f915a33e-f807-11ea-a328-fc4dd43d38a6.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report