MALICIOUS — bf57b5_f5a9507a583b46e4a55f4e329b4c95aa.pdf

MALICIOUS — bf57b5_f5a9507a583b46e4a55f4e329b4c95aa.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: fe621fc4e7fddd5682f9290b628e6cca9bac305cd1c04e4c00db5efe57dca4da
• SHA-1: e437558839eae8bea01f5148d24b833f75fee72a
• MD5: 7830dba7777ba11624988dd3ea9c0f1f
• ssdeep: 1536:9GFxfuSZW8zfxT5YxR+xFJgHPkt08nGCnHL11dnhbn9ZdLllR3uL:AFxm18J6xCDukpr1bh5lW
• TLSH: T1A638E0F31012ED8C9642EB437CEE20AA710EC68A60366F5855D8776DD57C5ECAF109E0
• Submitted as: bf57b5_f5a9507a583b46e4a55f4e329b4c95aa.pdf
• File type: pdf · Size: 82854 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=starmusiq+tamil+songs+2000, http://files.whiterivermwd.com/uploads/1/3/1/1/131164157/ruwuvat.pdf, http://bemudajat.ketchikanwhales.com/uploads/1/3/1/3/131384380/9976183.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=starmusiq+tamil+songs+2000
• http://files.whiterivermwd.com/uploads/1/3/1/1/131164157/ruwuvat.pdf
• http://bemudajat.ketchikanwhales.com/uploads/1/3/1/3/131384380/9976183.pdf
• http://xatore.onceuponabookauthorsigning.com/uploads/1/3/1/3/131380160/4159822.pdf
• http://valem.imcansw.org/uploads/1/3/0/9/130969354/zesowojasulasi.pdf
• https://cdn.shopify.com/s/files/1/0434/4171/7414/files/begum_rokeya_biography_in_bengali.pdf
• https://cdn.shopify.com/s/files/1/0432/3144/5156/files/55161745968.pdf
• https://cdn.shopify.com/s/files/1/0439/8468/3166/files/dibaduvusinoved.pdf
• https://cdn.shopify.com/s/files/1/0434/3165/7621/files/datasheet_fortigate_3600c.pdf
• https://cdn.shopify.com/s/files/1/0465/0663/9512/files/wowoverunasekumi.pdf
• https://cdn.shopify.com/s/files/1/0450/2038/1342/files/bottom_of_the_pyramid_ck_prahalad.pdf
• https://cdn.shopify.com/s/files/1/0433/2588/2518/files/pigapidekud.pdf
• https://cdn.shopify.com/s/files/1/0433/9888/9621/files/equidad_de_genero_en_el_deporte.pdf
• https://cdn.shopify.com/s/files/1/0436/5844/4958/files/koxapojotanewinoju.pdf
• https://cdn.shopify.com/s/files/1/0433/6756/3429/files/67576425946.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• files.whiterivermwd.com
• bemudajat.ketchikanwhales.com
• xatore.onceuponabookauthorsigning.com
• valem.imcansw.org
• cdn.shopify.com
• a10.gaanacdn.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report