MALICIOUS — 5dc3ca_6869b8b8237f4fa6826a8ef16eb3bbf8.pdf

MALICIOUS — 5dc3ca_6869b8b8237f4fa6826a8ef16eb3bbf8.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 12cfa102ccd0f3bf1f064d0ebfe2151a6975d0e7e9ee5739353d1c12672f142e
• SHA-1: 5b0e0609d13a413a5e90c23b94e8fb16c16b6806
• MD5: 1a92310355c8f3b38c5902f868738a2d
• ssdeep: 768:jgGzpD4JwrS2SN4UiFJgsbQ1dTYbnLkxcwkMJkEu8oO9HKlJhflJtVoGlz:cGFk2hB/0TWAVu8P9HKlzljCGlz
• TLSH: T117329DF351ABEC4D79C3DB076DA9118DA149DB8D6022A6B058E4323CC4B83BD7E40A75
• Submitted as: 5dc3ca_6869b8b8237f4fa6826a8ef16eb3bbf8.pdf
• File type: pdf · Size: 43883 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=cpap+nightstand+converter, https://cdn.shopify.com/s/files/1/0429/9476/1877/files/27282915620.pdf, https://cdn.shopify.com/s/files/1/0435/8271/8107/files/out_of_office_message_template_leaving_company.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=cpap+nightstand+converter
• https://cdn.shopify.com/s/files/1/0429/9476/1877/files/27282915620.pdf
• https://cdn.shopify.com/s/files/1/0435/8271/8107/files/out_of_office_message_template_leaving_company.pdf
• https://cdn.shopify.com/s/files/1/0433/7857/3464/files/jugikirexurezif.pdf
• https://89640d79-91b6-4b6a-a551-6b1a4560787d.filesusr.com/ugd/a4c1fa_5a44d5e0cd124d8eb00ae52e442701d1.pdf?index=true
• https://341f0071-18b3-42cf-96fb-52f8e0bd44ab.filesusr.com/ugd/6e13d9_9882b62bf556468e84a818492e04b636.pdf?index=true
• https://a377bda5-84a9-40a4-af4e-3fb29f0e343a.filesusr.com/ugd/6bb4a2_4e53771790864c69a26609604e928837.pdf?index=true
• https://0e63bded-a681-4f47-a747-04eaeb749e93.filesusr.com/ugd/61b8bf_cab0274edc814600933b3106e567d856.pdf?index=true
• https://5835b01c-64ff-4409-949c-21297875b02e.filesusr.com/ugd/162fe6_2562f701331a48708d0003ff904010dd.pdf?index=true
• https://cdn.shopify.com/s/files/1/0470/9659/4590/files/bluetooth_receiver_for_pc.pdf
• https://cdn.shopify.com/s/files/1/0433/7424/8101/files/52031715284.pdf
• https://cdn.shopify.com/s/files/1/0430/6848/9881/files/maternity_leave_letter_to_employee_template.pdf
• https://cdn.shopify.com/s/files/1/0448/1299/2674/files/vizix.pdf
• https://cdn.shopify.com/s/files/1/0435/0954/7174/files/22389631335.pdf
• https://277a5841-6cef-427c-b622-ba23a2bf30aa.filesusr.com/ugd/eddc50_6b8aa1a8484e4285b53f3920a5eb6da1.pdf?index=true
• https://6952710d-ded1-41c0-8cab-ad62d6abbea6.filesusr.com/ugd/0c60a0_e2df99d6eb974a7dac36dbf90fd8b3c6.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• cdn.shopify.com
• 89640d79-91b6-4b6a-a551-6b1a4560787d.filesusr.com
• 341f0071-18b3-42cf-96fb-52f8e0bd44ab.filesusr.com
• a377bda5-84a9-40a4-af4e-3fb29f0e343a.filesusr.com
• 0e63bded-a681-4f47-a747-04eaeb749e93.filesusr.com
• 5835b01c-64ff-4409-949c-21297875b02e.filesusr.com
• y.us
• 277a5841-6cef-427c-b622-ba23a2bf30aa.filesusr.com
• 6952710d-ded1-41c0-8cab-ad62d6abbea6.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report