MALICIOUS — 97aff7_2321c100b2f04c398ad69442aa5df952.pdf

MALICIOUS — 97aff7_2321c100b2f04c398ad69442aa5df952.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 54 detection engines flagged it.

Identification

• SHA-256: 24474361678e0158a04f0631fce1b37a49884e339c4bf353a3f16a84df51bc55
• SHA-1: 0ebab66d770af528be32e3994cfe91210e313262
• MD5: 98b1889e06957d95e53697eef2015680
• ssdeep: 768:mgGzpDq1aFrP4pT21cCR+VBCuXCFiZSp8Fy6IU/1KITPE9R5AnA6cnLHNHEZpul2:zGFetw1xMTk8AA1E3lrIWvAWoMbF11u
• TLSH: T10F36BFF35063ECDD7A8BAB03BD9E11696185CA897032A62044C87B7CD27C5BD7F80A11
• Submitted as: 97aff7_2321c100b2f04c398ad69442aa5df952.pdf
• File type: pdf · Size: 64657 bytes
• Verdict: malicious (78/100)

Detections (2 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=shin+megami+tensei+imagine+japanese+wiki, https://cdn.shopify.com/s/files/1/0431/1669/1612/files/corporate_ownership_structure_template.pdf, https://cdn.shopify.com/s/files/1/0437/0454/9531/files/blippo_black_outline_p_free.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=shin+megami+tensei+imagine+japanese+wiki
• https://cdn.shopify.com/s/files/1/0431/1669/1612/files/corporate_ownership_structure_template.pdf
• https://cdn.shopify.com/s/files/1/0437/0454/9531/files/blippo_black_outline_p_free.pdf
• https://cdn.shopify.com/s/files/1/0430/1714/2433/files/99484582258.pdf
• https://cdn.shopify.com/s/files/1/0432/1237/4174/files/61477536926.pdf
• https://cdn.shopify.com/s/files/1/0437/9534/9661/files/99134924892.pdf
• https://1cbf2bd2-18e1-4ae4-ba62-a5abc8826bd7.filesusr.com/ugd/44b221_e6640da9f8704c3b83c7d82c8d052dff.pdf?index=true
• https://ec8f3753-c5e8-4f64-b18c-d700404cae83.filesusr.com/ugd/610d21_0e7a0b55c0c74d728516f23705175bab.pdf?index=true
• https://5e89b0cc-80c0-422d-8199-1f3f00bf4ae5.filesusr.com/ugd/55f640_6a0967a004d445f6b50c64473d820a0a.pdf?index=true
• https://9dcc93ed-8c03-43aa-aec2-c21ec40a3f75.filesusr.com/ugd/d90490_a3a2b9a2a6044ba8ab6fb625fe6c9737.pdf?index=true
• https://a1c5989d-9efe-41a2-868f-f2e620ec91d5.filesusr.com/ugd/dfb5f8_092aae4d25d0493aa963416f94c0d6ca.pdf?index=true
• https://cdn.shopify.com/s/files/1/0433/9286/0318/files/malayalam_movies_2019_tamilrockers_hd.pdf
• https://cdn.shopify.com/s/files/1/0436/3347/5737/files/lafuz.pdf
• https://cdn.shopify.com/s/files/1/0431/6856/3355/files/98001320791.pdf
• https://cdn.shopify.com/s/files/1/0433/3872/7589/files/futinitubereluletirepe.pdf
• https://cdn.shopify.com/s/files/1/0457/9039/6572/files/ieee_format_for_project_report.pdf
• https://8c678df4-3143-4468-9134-3a9f3aa276cc.filesusr.com/ugd/e49726_ae2634626a1d486f8e2b1710c6a2ded4.pdf?index=true
• https://0f4d79d1-b4dc-4cf7-baa0-2b59e1e09d0d.filesusr.com/ugd/a3b54b_8bb50f389fe344aab1963422ef5774e1.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• cdn.shopify.com
• 1cbf2bd2-18e1-4ae4-ba62-a5abc8826bd7.filesusr.com
• ec8f3753-c5e8-4f64-b18c-d700404cae83.filesusr.com
• 5e89b0cc-80c0-422d-8199-1f3f00bf4ae5.filesusr.com
• 9dcc93ed-8c03-43aa-aec2-c21ec40a3f75.filesusr.com
• a1c5989d-9efe-41a2-868f-f2e620ec91d5.filesusr.com
• 8c678df4-3143-4468-9134-3a9f3aa276cc.filesusr.com
• 0f4d79d1-b4dc-4cf7-baa0-2b59e1e09d0d.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report