MALICIOUS — dad90e_7807e24d904a4697bcbbbbabd67fb164.pdf

MALICIOUS — dad90e_7807e24d904a4697bcbbbbabd67fb164.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 09f850af82adff8f7de743bc7a78cccb5c00b47ed3e0831ffdf2f7f97db9185d
• SHA-1: 4c63e4d871d322afaeb97de293986c2085e41e18
• MD5: f704cf4fcae2e7c576407ac3b4e99a26
• ssdeep: 768:/gGzpDPWwPew3R3GxgsBRwCMlUD+KFzBt+6h0aOn+:IGFTBGxgTCMeDJFH0aOn+
• TLSH: T1E8319EF310ABDD8C39D7AF43AAE605A87045D6893132E5A049993B6CC8385FD7F41A70
• Submitted as: dad90e_7807e24d904a4697bcbbbbabd67fb164.pdf
• File type: pdf · Size: 39600 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=schumacher+xc103w+manual, https://5085ab10-97ee-4557-a2e4-ebb072463c1c.filesusr.com/ugd/10b03a_132507881ab34998ad41eb35f920ac49.pdf?index=true, https://54947114-0a47-4fb3-b06f-4db4ffaccfc8.filesusr.com/ugd/3254bf_3e290d7e72104e19bf058ef9b5a69c46.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=schumacher+xc103w+manual
• https://5085ab10-97ee-4557-a2e4-ebb072463c1c.filesusr.com/ugd/10b03a_132507881ab34998ad41eb35f920ac49.pdf?index=true
• https://54947114-0a47-4fb3-b06f-4db4ffaccfc8.filesusr.com/ugd/3254bf_3e290d7e72104e19bf058ef9b5a69c46.pdf?index=true
• https://37e923ed-3bea-4a98-8a68-f172e4890e37.filesusr.com/ugd/ea2f88_8d8beaaac74e46a1b058eb32068b3819.pdf?index=true
• https://cdn.shopify.com/s/files/1/0434/5459/5224/files/fotebanawap.pdf
• https://cdn.shopify.com/s/files/1/0428/2299/2028/files/ayuno_intermitente_y_dieta_cetogenica.pdf
• https://cdn.shopify.com/s/files/1/0437/2099/9064/files/78554507506.pdf
• https://cdn.shopify.com/s/files/1/0434/8513/5014/files/71130408734.pdf
• https://8d01197f-4de3-46d1-8e80-45441ada520a.filesusr.com/ugd/bfbc46_c96ea4940a4540509b12b706e1984725.pdf?index=true
• https://70bcfdb9-349e-47d5-8207-3e75e2e9f624.filesusr.com/ugd/31bf02_cf2b50e4a2b64ca88ff81a3f7ed2bfd7.pdf?index=true
• https://b62e4fa8-ca95-4eb2-8dab-207c7cc807a8.filesusr.com/ugd/008e52_c03530a630b74b14a9f30e22669d00c8.pdf?index=true
• https://bd8a0568-1349-43d5-beb7-ce1acf607c1b.filesusr.com/ugd/b42fd6_cbd8e96888c7492a8e825c9b927226d4.pdf?index=true
• https://d59e48d2-5bce-4d1c-96d1-5a6d61e07b4b.filesusr.com/ugd/e3ed1f_2776b679f0bb4d32b336ef63f9d4ffe9.pdf?index=true
• https://3820cca7-9d4b-4978-935b-3369f271c230.filesusr.com/ugd/97aff7_dff97ec9305e495e9813821f04679da8.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• 5085ab10-97ee-4557-a2e4-ebb072463c1c.filesusr.com
• 54947114-0a47-4fb3-b06f-4db4ffaccfc8.filesusr.com
• 37e923ed-3bea-4a98-8a68-f172e4890e37.filesusr.com
• cdn.shopify.com
• 8d01197f-4de3-46d1-8e80-45441ada520a.filesusr.com
• 70bcfdb9-349e-47d5-8207-3e75e2e9f624.filesusr.com
• b62e4fa8-ca95-4eb2-8dab-207c7cc807a8.filesusr.com
• bd8a0568-1349-43d5-beb7-ce1acf607c1b.filesusr.com
• d59e48d2-5bce-4d1c-96d1-5a6d61e07b4b.filesusr.com
• 3820cca7-9d4b-4978-935b-3369f271c230.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report