MALICIOUS — debdc1_d8c8984138a54e4994fd91e2b56a1f3d.pdf

MALICIOUS — debdc1_d8c8984138a54e4994fd91e2b56a1f3d.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 54 detection engines flagged it.

Identification

• SHA-256: 109d47e9f87a3e6b3b7357dff9c6a303c830d1656cabf7d610f81680a326dde0
• SHA-1: f136ed1fc6b8eb2b9dca5e9b0e034bcc64d451b8
• MD5: 4402c0085f0b97247e4c5c4fb4a6a8a9
• ssdeep: 1536:RGFpo1SeX0ZXDjlw2QktT5x4o6GlHctsN:0FpmkHxQImohHcQ
• TLSH: T13136CFF31197DD8E7DCA6F13ADDA10A85049C688A126A77158DC673CC47C6FD2E20A12
• Submitted as: debdc1_d8c8984138a54e4994fd91e2b56a1f3d.pdf
• File type: pdf · Size: 69566 bytes
• Verdict: malicious (78/100)

Detections (2 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=highland+park+track+wiki, https://cdn.shopify.com/s/files/1/0430/9444/2133/files/36569244596.pdf, https://cdn.shopify.com/s/files/1/0437/0821/9547/files/branches_of_science_worksheet_middle_school.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=highland+park+track+wiki
• https://cdn.shopify.com/s/files/1/0430/9444/2133/files/36569244596.pdf
• https://cdn.shopify.com/s/files/1/0437/0821/9547/files/branches_of_science_worksheet_middle_school.pdf
• https://cdn.shopify.com/s/files/1/0434/7219/1641/files/motu_patlu_ki_jodi_full_free.pdf
• https://cdn.shopify.com/s/files/1/0434/2457/9736/files/50409379111.pdf
• https://cdn.shopify.com/s/files/1/0458/2555/6643/files/putlocker_end_game.pdf
• https://cdn.shopify.com/s/files/1/0433/0687/7080/files/xazome.pdf
• https://cdn.shopify.com/s/files/1/0436/2846/2243/files/68460522374.pdf
• https://cdn.shopify.com/s/files/1/0432/1034/2563/files/11280546166.pdf
• https://cdn.shopify.com/s/files/1/0427/6482/8838/files/480189183.pdf
• https://ca36e547-b6cf-481e-bbc3-35431c5b11c0.filesusr.com/ugd/510a18_d12c26bf463b4561aad73e382d277560.pdf?index=true
• https://fc1736ec-c7dd-4b55-8b48-e9677e31fb6d.filesusr.com/ugd/d1fcfc_93370d14ad9344b294d7e308fc6828e7.pdf?index=true
• https://b6fc4ca0-f5e1-4086-a824-cddebc8f88e3.filesusr.com/ugd/c83fdb_ac51f000503f47b4b74f3aebe4f53660.pdf?index=true
• https://cdn.shopify.com/s/files/1/0434/5469/3529/files/mi_android_one_mobile_list.pdf
• https://cdn.shopify.com/s/files/1/0433/4275/8056/files/46760398354.pdf
• https://cdn.shopify.com/s/files/1/0429/2627/6775/files/nuteputawol.pdf
• https://cdn.shopify.com/s/files/1/0437/2620/9175/files/amazon_fba_checklist.pdf
• https://cdn.shopify.com/s/files/1/0434/0331/3308/files/culinary_arts_2_final_exam_study_guide.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• cdn.shopify.com
• ca36e547-b6cf-481e-bbc3-35431c5b11c0.filesusr.com
• fc1736ec-c7dd-4b55-8b48-e9677e31fb6d.filesusr.com
• b6fc4ca0-f5e1-4086-a824-cddebc8f88e3.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report