MALICIOUS — c345b0_31d509ea1f9c462985262d0a7d9d5167.pdf

MALICIOUS — c345b0_31d509ea1f9c462985262d0a7d9d5167.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

SHA-256: 1d1c7497109c31755524a3be73789d26d9424158716328ec9d58ddd989a58c4a
SHA-1: e5a2fae84133e03921c18a0fcafc937dff7b73cc
MD5: 45135447888600933415ed98b2d66712
ssdeep: 768:bgGzpDgdn93/xcQYn4hfS99GHkZO2u8IH2SE2OR5WpVbgIQuBV:kGF0RHkZph24EVbQuBV
TLSH: T12031AEF350A7DD8D7A86EB07BEEA114F6048E6482032E62559993B6CD43C3BD7F50620
Submitted as: c345b0_31d509ea1f9c462985262d0a7d9d5167.pdf
File type: pdf · Size: 40286 bytes
Verdict: malicious (78/100)

Detections (2 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ttraff.me/wix?keyword=roadways+word+whizzle+search+answers, https://03ba06fe-2ddf-4a10-9b23-601c0a4012ba.filesusr.com/ugd/96564c_afcf61400b4d44fe98a2c5b900950ccf.pdf?index=true, https://f89594f3-9d5b-45fa-ac65-3e970d4d79af.filesusr.com/ugd/b73feb_aec3c56bf979430c90245b1d851d8e97.pdf?index=true - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://ttraff.me/wix?keyword=roadways+word+whizzle+search+answers
https://03ba06fe-2ddf-4a10-9b23-601c0a4012ba.filesusr.com/ugd/96564c_afcf61400b4d44fe98a2c5b900950ccf.pdf?index=true
https://f89594f3-9d5b-45fa-ac65-3e970d4d79af.filesusr.com/ugd/b73feb_aec3c56bf979430c90245b1d851d8e97.pdf?index=true
https://516abd72-65ed-45eb-8938-d76eadcbba7d.filesusr.com/ugd/e2b09b_e0c0c3105cb5495b8e6abaeef775189e.pdf?index=true
https://f89c7a37-7d04-4ae2-9fe4-f7d1940e1de1.filesusr.com/ugd/55cc32_486dbafb02bb402e91ded285e11db9b3.pdf?index=true
https://cdn.shopify.com/s/files/1/0429/9577/7699/files/82018493807.pdf
https://cdn.shopify.com/s/files/1/0434/2294/1351/files/dbrau_date_sheet_2019_m._com.pdf
https://cdn.shopify.com/s/files/1/0428/9835/8432/files/66916333827.pdf
https://cdn.shopify.com/s/files/1/0430/7707/5108/files/fusajuvos.pdf
https://cdn.shopify.com/s/files/1/0429/4426/6399/files/55310256306.pdf
https://cdn.shopify.com/s/files/1/0462/5462/0821/files/lithium_metal_battery_safety_data_sheet.pdf
https://cdn.shopify.com/s/files/1/0463/1062/1341/files/xubebok.pdf
https://cdn.shopify.com/s/files/1/0431/2363/8426/files/32189351877.pdf
https://cdn.shopify.com/s/files/1/0429/5249/1159/files/21610836770.pdf
https://cdn.shopify.com/s/files/1/0438/2598/7734/files/ludufonilesoridabajoxom.pdf
https://cdn.shopify.com/s/files/1/0435/0597/5462/files/toditorutoxurifolikexuvit.pdf
https://cdn.shopify.com/s/files/1/0428/9835/8432/files/98973723668.pdf
https://cdn.shopify.com/s/files/1/0465/5162/9974/files/xutakimaxumageli.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ttraff.me
03ba06fe-2ddf-4a10-9b23-601c0a4012ba.filesusr.com
f89594f3-9d5b-45fa-ac65-3e970d4d79af.filesusr.com
516abd72-65ed-45eb-8938-d76eadcbba7d.filesusr.com
f89c7a37-7d04-4ae2-9fe4-f7d1940e1de1.filesusr.com
cdn.shopify.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report