MALICIOUS — d017d5_dabf51ac68244316bbd31a2ebdb374ef.pdf

MALICIOUS — d017d5_dabf51ac68244316bbd31a2ebdb374ef.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

SHA-256: 0e97d580ff7f3acd3ce214462300adf267f870aeda8d2c4bf2b7a3820cb644d7
SHA-1: 80342798b18e547a3a1f1e558fcc17d6623ba349
MD5: 747558097ad17f68d3b29ad6f4d09575
ssdeep: 768:KgGzpDNYPiRhBl42nedV+7agyiV9LdkWMXZE1S52o7R+p3At:XGFZYAedV+AOL0ZoS52o7Rq3At
TLSH: T19031CEF39057ED8C76879F136DAA1498604AD38C60328B6469C87B6CC4BC2FDBE50960
Submitted as: d017d5_dabf51ac68244316bbd31a2ebdb374ef.pdf
File type: pdf · Size: 42896 bytes
Verdict: malicious (78/100)

Detections (2 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ttraff.club/wix?keyword=download+sixaxis+controller+apk+1.1.3, https://1e48a320-3e5e-4bc8-b382-c2b44f8222eb.filesusr.com/ugd/88a84f_d3556335b1fd43d9b22e7c63c84f038b.pdf?index=true, https://a30f8319-cd6e-4d3a-9781-0fdb05c6ca86.filesusr.com/ugd/83f04e_a01946885fe44d3f98a7153940eccb7a.pdf?index=true - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://ttraff.club/wix?keyword=download+sixaxis+controller+apk+1.1.3
https://1e48a320-3e5e-4bc8-b382-c2b44f8222eb.filesusr.com/ugd/88a84f_d3556335b1fd43d9b22e7c63c84f038b.pdf?index=true
https://a30f8319-cd6e-4d3a-9781-0fdb05c6ca86.filesusr.com/ugd/83f04e_a01946885fe44d3f98a7153940eccb7a.pdf?index=true
https://5597d8b0-05b3-4f0c-909a-e340333c3339.filesusr.com/ugd/a421e3_beb850def7204ac39514e0c72b7eadeb.pdf?index=true
https://cdn.shopify.com/s/files/1/0481/7551/3749/files/newest_movies_hd_apk_free_download.pdf
https://cdn.shopify.com/s/files/1/0432/6280/4136/files/32717239710.pdf
https://cdn.shopify.com/s/files/1/0433/8899/3703/files/sodexuzojuzatalugatu.pdf
https://cdn.shopify.com/s/files/1/0434/5026/9849/files/cantharellus_tubaeformis_lutescens.pdf
https://45ede71e-71fa-4725-a8cf-b848aa0d94b0.filesusr.com/ugd/d32f78_09f74e254df74c0d8316977b2e242e57.pdf?index=true
https://c135d3f4-2021-4a78-81c5-bdb607939ff5.filesusr.com/ugd/2a1429_353cfc7145774f9c8dbc6b8efa0a1378.pdf?index=true
https://285873d5-b673-4ee4-a7ee-84449620a6ac.filesusr.com/ugd/cb2bed_f6a795c513a04aabb14c540349bea160.pdf?index=true
https://41b54797-66b7-4f13-b9af-0c8c2e622563.filesusr.com/ugd/8acad3_bcc38e5377a142878109cb9e1556d8d5.pdf?index=true
https://3e657758-07ce-4111-9c66-22d932f80176.filesusr.com/ugd/0c8cc8_880814f820724226b0abd7ab0b3b0e21.pdf?index=true
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ttraff.club
1e48a320-3e5e-4bc8-b382-c2b44f8222eb.filesusr.com
a30f8319-cd6e-4d3a-9781-0fdb05c6ca86.filesusr.com
5597d8b0-05b3-4f0c-909a-e340333c3339.filesusr.com
cdn.shopify.com
45ede71e-71fa-4725-a8cf-b848aa0d94b0.filesusr.com
c135d3f4-2021-4a78-81c5-bdb607939ff5.filesusr.com
285873d5-b673-4ee4-a7ee-84449620a6ac.filesusr.com
41b54797-66b7-4f13-b9af-0c8c2e622563.filesusr.com
3e657758-07ce-4111-9c66-22d932f80176.filesusr.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report