MALICIOUS — 7ef0dc_f6fc185a123e4cf993817b5d82422e2e.pdf

MALICIOUS — 7ef0dc_f6fc185a123e4cf993817b5d82422e2e.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: faeb6c467d868d3c26f850e8ceed66c8a7b4cbffd76f8f0b494f047c6ccb7416
• SHA-1: 76afefec314b821ff2f04a236ae9433ceb8a279a
• MD5: ff06a34ea9bbe21ef47d41791ff66069
• ssdeep: 768:SgGzpDegTV1dK33yu9K0OY2t0+Ilx4st5bp8wheknQedtm92XRXy1VCd3BcEb2md:PGFSgQUsPbpFQedm2XBy1Vm3OjmOEkHK
• TLSH: T17431AFF310A7ED8D3A8BAF576DE7105A6105D78DB132A6600488771CE4BCAFD7E10622
• Submitted as: 7ef0dc_f6fc185a123e4cf993817b5d82422e2e.pdf
• File type: pdf · Size: 41136 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.PDF.Agent.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.PDF.Agent.gen (rule HEUR:Trojan.PDF.Agent.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=powerdirector+12+windows+10, https://cdn.shopify.com/s/files/1/0428/6870/3398/files/saligifemufadomusave.pdf, https://cdn.shopify.com/s/files/1/0433/5550/4795/files/how_to_dump_a_3ds_game.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=powerdirector+12+windows+10
• https://cdn.shopify.com/s/files/1/0428/6870/3398/files/saligifemufadomusave.pdf
• https://cdn.shopify.com/s/files/1/0433/5550/4795/files/how_to_dump_a_3ds_game.pdf
• https://cdn.shopify.com/s/files/1/0431/6758/0317/files/21050338520.pdf
• https://cdn.shopify.com/s/files/1/0432/6916/1110/files/tarsal_bones_anatomy.pdf
• https://cdn.shopify.com/s/files/1/0432/5359/6324/files/78944266099.pdf
• https://cdn.shopify.com/s/files/1/0434/1186/5751/files/78451912195.pdf
• https://cdn.shopify.com/s/files/1/0436/7453/4041/files/delhi_metro_map_with_fare.pdf
• https://cdn.shopify.com/s/files/1/0432/3688/4642/files/audio_to_text_android_library.pdf
• https://cdn.shopify.com/s/files/1/0427/5165/6102/files/62216205017.pdf
• https://cdn.shopify.com/s/files/1/0437/2417/7557/files/autobiographical_essay_as_a_reader_and_writer.pdf
• https://cdn.shopify.com/s/files/1/0428/8764/3303/files/boardwalk_empire_torrent.pdf
• https://cdn.shopify.com/s/files/1/0439/4103/6200/files/google_sheets_single_sheet.pdf
• https://cdn.shopify.com/s/files/1/0429/2250/8454/files/57633084216.pdf
• https://cdn.shopify.com/s/files/1/0429/0464/9884/files/template_for_small_gift_box_free.pdf
• https://cdn.shopify.com/s/files/1/0465/0926/0958/files/59403753304.pdf
• https://cdn.shopify.com/s/files/1/0432/1430/7496/files/10228917351.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report