MALICIOUS — c5d40f_980422cf832d4895be9f6cb3d241fc34.pdf

MALICIOUS — c5d40f_980422cf832d4895be9f6cb3d241fc34.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: f7d95c3ed122f0e63380fac5db1ef0fb63a55eb9485bd63b3d08f455198bb47a
• SHA-1: 1fe2c3a42c5f5c2c207260fe04fa2d1d79b825de
• MD5: bfd854c0f8247909622cfa32d0fcdb5f
• ssdeep: 768:HgGzpDRWk49eCmb2yH3HYLQHeVK69ekqdNJ0LZLDt+dXjlG:AGFFWkssHXKK6UkqzJ0LVt+dXjlG
• TLSH: T1B5329FF3549BEC882686AB83ADDA11557195D6CD6122A75094EC7B3CC0BC3FDBF20920
• Submitted as: c5d40f_980422cf832d4895be9f6cb3d241fc34.pdf
• File type: pdf · Size: 43963 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=words+that+have+q+and+c+in+them, https://7d55ab2e-7f39-47c2-acc4-28c25295e08b.filesusr.com/ugd/3402b1_6140bd1196aa4c62aca674f6f0edfd6a.pdf?index=true, https://825a1024-bb7a-4adf-92c6-b914ac21ddab.filesusr.com/ugd/f1780b_6fdeed7b85a149749cb18f9e1e52f613.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=words+that+have+q+and+c+in+them
• https://7d55ab2e-7f39-47c2-acc4-28c25295e08b.filesusr.com/ugd/3402b1_6140bd1196aa4c62aca674f6f0edfd6a.pdf?index=true
• https://825a1024-bb7a-4adf-92c6-b914ac21ddab.filesusr.com/ugd/f1780b_6fdeed7b85a149749cb18f9e1e52f613.pdf?index=true
• https://f09a5007-f62a-471d-a487-f9e5523b12eb.filesusr.com/ugd/89064d_00c568b66dd34adb94a6d30d27c3578f.pdf?index=true
• https://47f7d3a8-a61f-4c0b-94c8-2299b86cc008.filesusr.com/ugd/f1780b_663b1be722764119ab49021767afe161.pdf?index=true
• https://15783b36-dfb9-4985-98aa-aacf8cafcc27.filesusr.com/ugd/f08e01_4846cf75986a4b6cb8384929c66e3659.pdf?index=true
• https://fd70b3ba-d63b-4c56-94a2-5c0960e56e03.filesusr.com/ugd/bc0b97_8934116a28504ae4b48e3547f62ee38b.pdf?index=true
• https://eb2a098c-8d3b-4ac5-ada1-1923ac1d4cb1.filesusr.com/ugd/b463f2_4ca5b067b49c42d081b40234547705c8.pdf?index=true
• https://422fb5fc-6236-48e6-8f14-51201c7c58f9.filesusr.com/ugd/bc0b97_c0ac0885d1514a4e8e1573177fa07ec6.pdf?index=true
• https://9ff1e5f7-eaa6-44db-b2a4-82af6c2595d7.filesusr.com/ugd/4b874d_bafc99100d324296b231331692e08fa4.pdf?index=true
• https://c28fb291-7a9f-4b44-978e-8e7a36450a77.filesusr.com/ugd/035627_60b3acb8c6674d0494febe036978ba1f.pdf?index=true
• https://4e2bd541-a0de-4997-a109-176b0faff25a.filesusr.com/ugd/69695d_358f25d4cce648e49c7e557145f8454c.pdf?index=true
• https://f89c9433-75eb-4e86-90f6-61ef89f4a7e5.filesusr.com/ugd/370021_d50f821724264002ab3a7516c7df828a.pdf?index=true
• https://c7c728f6-cf91-4e96-9700-25b08de6aa92.filesusr.com/ugd/35c6e2_002ccd5e46dd43e0a1e4b63912611c10.pdf?index=true
• https://92d57ef1-3ddb-446e-a267-82dc643b3641.filesusr.com/ugd/c5d40f_198c9412e5da4afc8681b0676a058098.pdf?index=true
• https://cba23d9f-93f6-4a7a-92c3-c4cb8a3e8d70.filesusr.com/ugd/89602e_c27b72734ab3458b8978ca2776c1aed7.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• 7d55ab2e-7f39-47c2-acc4-28c25295e08b.filesusr.com
• 825a1024-bb7a-4adf-92c6-b914ac21ddab.filesusr.com
• f09a5007-f62a-471d-a487-f9e5523b12eb.filesusr.com
• 47f7d3a8-a61f-4c0b-94c8-2299b86cc008.filesusr.com
• 15783b36-dfb9-4985-98aa-aacf8cafcc27.filesusr.com
• fd70b3ba-d63b-4c56-94a2-5c0960e56e03.filesusr.com
• eb2a098c-8d3b-4ac5-ada1-1923ac1d4cb1.filesusr.com
• 422fb5fc-6236-48e6-8f14-51201c7c58f9.filesusr.com
• 9ff1e5f7-eaa6-44db-b2a4-82af6c2595d7.filesusr.com
• c28fb291-7a9f-4b44-978e-8e7a36450a77.filesusr.com
• 4e2bd541-a0de-4997-a109-176b0faff25a.filesusr.com
• f89c9433-75eb-4e86-90f6-61ef89f4a7e5.filesusr.com
• c7c728f6-cf91-4e96-9700-25b08de6aa92.filesusr.com
• 92d57ef1-3ddb-446e-a267-82dc643b3641.filesusr.com
• cba23d9f-93f6-4a7a-92c3-c4cb8a3e8d70.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report