MALICIOUS — b90ba1_9329497b1f2b41f8902c4d90e5759253.pdf

MALICIOUS — b90ba1_9329497b1f2b41f8902c4d90e5759253.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: f60a725eb93c758d3584a4bd8f4e24e2837157fc2468884bc51bb1b70a687a95
• SHA-1: 2c6f4c5d6481c9d65faef998e9e74a9a709eb849
• MD5: 0d28571c79cbf8cda11cb4c88a74329e
• ssdeep: 1536:+KGF3U6ebsB2b6RCgMHeyJnyNAfI0Bik6y0lH/9WwFjaSayOEnABpyqnvN:+zF33ebq46jM+2yeIjtjlH/9W4ayOnPr
• TLSH: T14D38D0F3505BEC8D7AAA9F038DF611566009E78D312ADB64088C776CC9BC6EDBD00A51
• Submitted as: b90ba1_9329497b1f2b41f8902c4d90e5759253.pdf
• File type: pdf · Size: 78426 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=caldwell+county+register+of+deeds+lenoir+nc, https://cdn.shopify.com/s/files/1/0433/6120/6422/files/49140370149.pdf, https://cdn.shopify.com/s/files/1/0436/9884/7896/files/agile_development_methodology.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=caldwell+county+register+of+deeds+lenoir+nc
• https://cdn.shopify.com/s/files/1/0433/6120/6422/files/49140370149.pdf
• https://cdn.shopify.com/s/files/1/0436/9884/7896/files/agile_development_methodology.pdf
• https://cdn.shopify.com/s/files/1/0431/4392/1820/files/98221764536.pdf
• https://cdn.shopify.com/s/files/1/0428/9078/9020/files/71363736181.pdf
• https://cdn.shopify.com/s/files/1/0432/2705/4237/files/toyota_automatic_transmission_repair_manual.pdf
• https://235fd3b6-c81a-4169-be92-020b64e254af.filesusr.com/ugd/2994dd_93a104e0b6da43428e445225d401fef3.pdf?index=true
• https://588c4f28-f06e-4085-882e-939ca294e987.filesusr.com/ugd/c722c2_396cdfae73114d20885f57f9881c3eb0.pdf?index=true
• https://1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com/ugd/227d0f_f21861fd7cd84aa7b9b29a8b14cd40ef.pdf?index=true
• https://1f7757ca-f808-11ea-a328-fc4dd43d38a6.filesusr.com/ugd/5ccfc8_84a2f4303a114b63840edb0748c495db.pdf?index=true
• https://cdn.shopify.com/s/files/1/0434/3031/4133/files/71512204057.pdf
• https://cdn.shopify.com/s/files/1/0427/6797/4556/files/google_sheets_if_cell_is_not_empty.pdf
• https://cdn.shopify.com/s/files/1/0436/6467/0873/files/vetubutafipav.pdf
• https://cdn.shopify.com/s/files/1/0437/3449/9493/files/46268903346.pdf
• https://cdn.shopify.com/s/files/1/0434/6596/5718/files/somowaris.pdf
• https://cdn.shopify.com/s/files/1/0429/2942/2499/files/full_forms_of_computer_abbreviations.pdf
• https://cdn.shopify.com/s/files/1/0431/8570/1019/files/66402936519.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• cdn.shopify.com
• 235fd3b6-c81a-4169-be92-020b64e254af.filesusr.com
• 588c4f28-f06e-4085-882e-939ca294e987.filesusr.com
• 1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com
• 1f7757ca-f808-11ea-a328-fc4dd43d38a6.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report