MALICIOUS — 9ea91e_cdfce20881e8448eb7fbb56b2b1d5d27.pdf

MALICIOUS — 9ea91e_cdfce20881e8448eb7fbb56b2b1d5d27.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: fc311bff96c4c0138b7a3c91dac387a7599a708296ee4bf6197e512178e28611
• SHA-1: e7d85aa090305336b56754ea34d7b325b27970b2
• MD5: 258316093c5ad0d7f77366e707847f67
• ssdeep: 768:FgGzpDyBNyyhjAWrELKqEIffONXE3VeWk/ugIz/D2wi:WGFut8Wr+EMfONXeFk/MD2wi
• TLSH: T133307BF3509BDC8CBAC7AB176DE611847186EB496137A62065D87BACC47C2FCAE10520
• Submitted as: 9ea91e_cdfce20881e8448eb7fbb56b2b1d5d27.pdf
• File type: pdf · Size: 38606 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=5th+grade+rocks+poster, https://6e39d444-2d9e-4dd6-ac80-13def0916faa.filesusr.com/ugd/3ed902_160072044b6244adb92f7305fc7d68b0.pdf?index=true, https://d01ddaca-8f3f-4c38-b54d-2ce333cc530c.filesusr.com/ugd/f08e01_8efdb059ba1143dd99aa8300918a67bb.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=5th+grade+rocks+poster
• https://6e39d444-2d9e-4dd6-ac80-13def0916faa.filesusr.com/ugd/3ed902_160072044b6244adb92f7305fc7d68b0.pdf?index=true
• https://d01ddaca-8f3f-4c38-b54d-2ce333cc530c.filesusr.com/ugd/f08e01_8efdb059ba1143dd99aa8300918a67bb.pdf?index=true
• https://146dee01-328c-4163-ad4e-394869d7c9de.filesusr.com/ugd/b926a8_6bc97925929c42e9972991381cbb8f39.pdf?index=true
• https://76161fb8-02b5-494f-901f-40786805b386.filesusr.com/ugd/3283b0_4dea5fab7d0d4892aed3fcb36818d053.pdf?index=true
• https://8a892f84-fc96-4baa-8ca5-d835c1f8378c.filesusr.com/ugd/e3325f_2356872449f346b6bec17da9127c2174.pdf?index=true
• https://3e8ab2fc-0a6f-4da0-b961-0ebf096d845a.filesusr.com/ugd/4a2613_687790be15ce4d8d9a41a9b8db1ac81b.pdf?index=true
• https://c4fe7d65-d0af-49a5-9d64-52b9f274bfad.filesusr.com/ugd/565485_54cbb6af095344d0ad5c96b6651f0345.pdf?index=true
• https://5acef51e-3035-43f4-8e2d-ee560377190a.filesusr.com/ugd/384ea4_0313c60b27f3441dbce8aa2e03260195.pdf?index=true
• https://c913da80-ab33-4a44-9099-b165f8e15976.filesusr.com/ugd/f3cb45_b71fd99ba29c482092664449186df7b3.pdf?index=true
• https://56571d8e-da81-4957-8457-1ea49a884177.filesusr.com/ugd/3f2390_02da3c67cb1c4f5fa049cf5e931fca1c.pdf?index=true
• https://177ea60a-5d15-4fa6-bc4b-254c90950b07.filesusr.com/ugd/edb4a7_ceabb44e8b584c06803664ab920a0fbe.pdf?index=true
• https://4d672074-cf1c-4a58-8532-0241377e3cf2.filesusr.com/ugd/529dbf_7113f53015f24ea1b184b981a81eab05.pdf?index=true
• https://66942a77-f117-49a2-8781-18d2a762429c.filesusr.com/ugd/067ecb_c0721618e8dd47aab882aef7c6092ad3.pdf?index=true
• https://61ef9585-d526-462b-9979-158a1114d49d.filesusr.com/ugd/dcf311_d5d832e6683a4d93a599015a12763720.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• 6e39d444-2d9e-4dd6-ac80-13def0916faa.filesusr.com
• d01ddaca-8f3f-4c38-b54d-2ce333cc530c.filesusr.com
• 146dee01-328c-4163-ad4e-394869d7c9de.filesusr.com
• 76161fb8-02b5-494f-901f-40786805b386.filesusr.com
• 8a892f84-fc96-4baa-8ca5-d835c1f8378c.filesusr.com
• 3e8ab2fc-0a6f-4da0-b961-0ebf096d845a.filesusr.com
• c4fe7d65-d0af-49a5-9d64-52b9f274bfad.filesusr.com
• 5acef51e-3035-43f4-8e2d-ee560377190a.filesusr.com
• c913da80-ab33-4a44-9099-b165f8e15976.filesusr.com
• 56571d8e-da81-4957-8457-1ea49a884177.filesusr.com
• 177ea60a-5d15-4fa6-bc4b-254c90950b07.filesusr.com
• 4d672074-cf1c-4a58-8532-0241377e3cf2.filesusr.com
• 66942a77-f117-49a2-8781-18d2a762429c.filesusr.com
• 61ef9585-d526-462b-9979-158a1114d49d.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report