MALICIOUS — 49f5ef_c8ae5d7891c241699639d69a5c6e7e4e.pdf

MALICIOUS — 49f5ef_c8ae5d7891c241699639d69a5c6e7e4e.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: ff12920cf1078bffb05a1034735df4510207058cfee7acae401ab29ff61f3451
• SHA-1: bdd037f65844cccbd40a71073d7fbf849c1113a4
• MD5: 6892999d06c7321bcc292f3c31427a2a
• ssdeep: 768:xgGzpDS41GY1RorccyLMVAE4uxPOcb6eodsZzyzAl/kUM7udUd:CGFe+gVAMVAUWcbudsZuUad7udUd
• TLSH: T10832B0F300B7DDCCAA87AF17EDAA11296045D649623297A015D87B6CC4783FDBE10A31
• Submitted as: 49f5ef_c8ae5d7891c241699639d69a5c6e7e4e.pdf
• File type: pdf · Size: 47208 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=chapter+7+ancient+india+crossword+puzzle+answers, https://ba986bd7-4b89-46a5-85e3-052755aa2964.filesusr.com/ugd/682d1c_037d700f08614be2a9068465e6136d76.pdf?index=true, https://c337a575-84db-4053-9880-2a26f81e1158.filesusr.com/ugd/e948c1_9efaac0139ce4314988e664a8c092000.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=chapter+7+ancient+india+crossword+puzzle+answers
• https://ba986bd7-4b89-46a5-85e3-052755aa2964.filesusr.com/ugd/682d1c_037d700f08614be2a9068465e6136d76.pdf?index=true
• https://c337a575-84db-4053-9880-2a26f81e1158.filesusr.com/ugd/e948c1_9efaac0139ce4314988e664a8c092000.pdf?index=true
• https://8c56951e-fd4d-4a89-83d3-1b3a52b93c6e.filesusr.com/ugd/c5d40f_e860e26dfccd4c11a2ca583ccd9c437e.pdf?index=true
• https://6e488c02-77d3-4f53-afe2-46942bca33c5.filesusr.com/ugd/3f80ec_3de9dc66ce094d9eb8ea1f8c160b7dbe.pdf?index=true
• https://68a1a05d-3908-406c-9709-107562a3e5fe.filesusr.com/ugd/cc3ca9_f342df20ec8b4031bf7d048cd85c0b6f.pdf?index=true
• https://1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com/ugd/227d0f_f21861fd7cd84aa7b9b29a8b14cd40ef.pdf?index=true
• https://3dd1b2c9-36a0-483e-b46c-8bac5c7e573e.filesusr.com/ugd/3225da_831b50e9f73d488db4678ea2d6e96dfc.pdf?index=true
• https://5bd10c3e-34ad-4b4e-878f-546a999a2273.filesusr.com/ugd/35c6e2_b7b69ffcc8a94119a2c5babc8e19660e.pdf?index=true
• https://74f3db12-7bd5-4cbd-9f6e-80f808f209aa.filesusr.com/ugd/cc3ca9_4127ee1e46c54e878efaa54049b835e2.pdf?index=true
• https://bf1db2ca-2fdf-4dfa-9b42-03dcd12af893.filesusr.com/ugd/565485_3c9c8dbd95c14d8c8ddef9e6caf5c456.pdf?index=true
• https://61c1fe8e-984a-4a87-b6d2-d28da0e012d1.filesusr.com/ugd/33ab24_a6b09c148c2a4f46bfb89e784b9e99ea.pdf?index=true
• https://2347d01f-a141-4318-93f1-c4426636b895.filesusr.com/ugd/d2759c_e9daea5e7ef942e88b4c757bbae49e22.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• ba986bd7-4b89-46a5-85e3-052755aa2964.filesusr.com
• c337a575-84db-4053-9880-2a26f81e1158.filesusr.com
• 8c56951e-fd4d-4a89-83d3-1b3a52b93c6e.filesusr.com
• 6e488c02-77d3-4f53-afe2-46942bca33c5.filesusr.com
• 68a1a05d-3908-406c-9709-107562a3e5fe.filesusr.com
• 1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com
• 3dd1b2c9-36a0-483e-b46c-8bac5c7e573e.filesusr.com
• 5bd10c3e-34ad-4b4e-878f-546a999a2273.filesusr.com
• 74f3db12-7bd5-4cbd-9f6e-80f808f209aa.filesusr.com
• bf1db2ca-2fdf-4dfa-9b42-03dcd12af893.filesusr.com
• 61c1fe8e-984a-4a87-b6d2-d28da0e012d1.filesusr.com
• 2347d01f-a141-4318-93f1-c4426636b895.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report