MALICIOUS — 529dbf_033e29dfb52b4d439c1d6531b603e684.pdf

MALICIOUS — 529dbf_033e29dfb52b4d439c1d6531b603e684.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 074b902ce53e61d7fc800d148b121d0de928e231c9e6c5cb3d76886ecbe85fb3
• SHA-1: 0254f838cc3bb3a3c46ea94e96231975d626681a
• MD5: 3154f46f071a7467da3a3cba7f08f473
• ssdeep: 768:RgGzpDEkTqL39u7W+trmrXE8W8l1+fxYt7z2HmhPWdwb6d+SQSos:iGFYb+MhW8lqxYcGUw4Ws
• TLSH: T1DE31AEF36457DE8C3E5BAB136DA200556044CB8D2177A6B049C87BACC4BC7BDBE90960
• Submitted as: 529dbf_033e29dfb52b4d439c1d6531b603e684.pdf
• File type: pdf · Size: 41853 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=victoria+dougherty+instagram, https://cdn.shopify.com/s/files/1/0428/0962/2691/files/86737478406.pdf, https://cdn.shopify.com/s/files/1/0438/1681/2706/files/38633960042.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=victoria+dougherty+instagram
• https://cdn.shopify.com/s/files/1/0428/0962/2691/files/86737478406.pdf
• https://cdn.shopify.com/s/files/1/0438/1681/2706/files/38633960042.pdf
• https://cdn.shopify.com/s/files/1/0433/1077/6478/files/15263678541.pdf
• https://cdn.shopify.com/s/files/1/0432/3049/4878/files/fikikuvakarupuwoxijor.pdf
• https://e44549bd-12fd-4b7c-b908-53eec9a31cd0.filesusr.com/ugd/04e6f9_b65cc6f2903445bc8e18681965beaad1.pdf?index=true
• https://63ae099c-e61b-4b55-8ce8-2ce90d5324f3.filesusr.com/ugd/c1de29_4962fd8f89c44c828bee28ac0695b485.pdf?index=true
• https://279a4307-80ea-4d24-9c3a-0b85deb1e5b8.filesusr.com/ugd/3283b0_040d9cc1d45b470eb68e9bbdf8c833eb.pdf?index=true
• https://9bcc0bed-f8b9-4d96-b645-6b6e28ec1b2b.filesusr.com/ugd/33ab24_07a08e8f2cd24620a0d2837c51a3d133.pdf?index=true
• https://cdn.shopify.com/s/files/1/0434/6504/8214/files/20972019289.pdf
• https://cdn.shopify.com/s/files/1/0432/0883/5236/files/nirezimepetijipeguratewek.pdf
• https://42afa59b-367b-4bd3-b5c7-3eef62c36845.filesusr.com/ugd/a9248e_d96c42a1d1764d79b02e9bc0f212c999.pdf?index=true
• https://343aad55-06d0-4aae-ad6a-ced7d1c120d6.filesusr.com/ugd/6f5f23_83a2bf045dd1487e883ac179dcfd545a.pdf?index=true
• https://de88af28-073b-43a3-b9c4-35cbc9fd898f.filesusr.com/ugd/6e13d9_01229d0e446d4a2d94605ebb2de2a071.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• cdn.shopify.com
• e44549bd-12fd-4b7c-b908-53eec9a31cd0.filesusr.com
• 63ae099c-e61b-4b55-8ce8-2ce90d5324f3.filesusr.com
• 279a4307-80ea-4d24-9c3a-0b85deb1e5b8.filesusr.com
• 9bcc0bed-f8b9-4d96-b645-6b6e28ec1b2b.filesusr.com
• 42afa59b-367b-4bd3-b5c7-3eef62c36845.filesusr.com
• 343aad55-06d0-4aae-ad6a-ced7d1c120d6.filesusr.com
• de88af28-073b-43a3-b9c4-35cbc9fd898f.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report