MALICIOUS — 9cfd0a_49426a4561334cc89bde353733478c45.pdf

MALICIOUS — 9cfd0a_49426a4561334cc89bde353733478c45.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 13b26a5a4408154c44b583dfc553e27f5c231798147fd023f7e095911f333a42
• SHA-1: fe47e01039650f63e6ca57490dc446250b526d5e
• MD5: 51b7caf3b86c0f7c9f914b27f7809d03
• ssdeep: 768:rgGzpDgraqNpVHhDlhVFao5tv/xWnMsGJMmzXembtdV6i470PN1Z+g:UGFEfjXxqMVxzxbZ6x7KZ+g
• TLSH: T1D232BFF75067ED8C7B8AAF43AAE614292115C3487133A76429EC7B6CC87C2FC6E10951
• Submitted as: 9cfd0a_49426a4561334cc89bde353733478c45.pdf
• File type: pdf · Size: 44950 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=audio-technica+at2020+cardioid+condenser+microphone, https://cdn.shopify.com/s/files/1/0434/1520/8098/files/86196605450.pdf, https://cdn.shopify.com/s/files/1/0433/0687/7080/files/metiliwetizo.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=audio-technica+at2020+cardioid+condenser+microphone
• https://cdn.shopify.com/s/files/1/0434/1520/8098/files/86196605450.pdf
• https://cdn.shopify.com/s/files/1/0433/0687/7080/files/metiliwetizo.pdf
• https://cdn.shopify.com/s/files/1/0430/2825/0781/files/23045673460.pdf
• http://files.bridgewaterdairy.com/uploads/1/3/2/6/132695714/26b90.pdf
• http://wekob.clinpsychsarah.com/uploads/1/3/0/8/130874493/nokilavevabamek_fazapuditowuzu_faguva_puvem.pdf
• http://luzava.straight-to-the-bar.com/uploads/1/3/2/7/132740324/mejikik-miwuxukuzejad.pdf
• http://files.ryanlakanen.com/uploads/1/3/2/7/132710748/8670402.pdf
• https://cdn.shopify.com/s/files/1/0437/8414/3010/files/pojubigom.pdf
• https://cdn.shopify.com/s/files/1/0440/9825/7048/files/gutachtenstil_zivilrecht.pdf
• https://fe146f5e-f69c-4b63-b6bc-d4a76f9067f0.filesusr.com/ugd/09c3c7_3b1b5384e41d4c6298b4e6c927d44da2.pdf?index=true
• https://9c56c742-9742-4586-983c-abaabc1f6faa.filesusr.com/ugd/f2c1dc_1d0785378dbb4eba9360ff6865a891d2.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• cdn.shopify.com
• files.bridgewaterdairy.com
• wekob.clinpsychsarah.com
• luzava.straight-to-the-bar.com
• files.ryanlakanen.com
• fe146f5e-f69c-4b63-b6bc-d4a76f9067f0.filesusr.com
• 9c56c742-9742-4586-983c-abaabc1f6faa.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report