MALICIOUS — b7306e_2bfad5332d404dd3b20621e2efe6561e.pdf

MALICIOUS — b7306e_2bfad5332d404dd3b20621e2efe6561e.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

SHA-256: 283246f038f066a13554e94cdd75703bda86c398d424398a8334af4962b1aa5d
SHA-1: f8751628546c10a2e3eca4d80d97936eca664c72
MD5: 608d2f19afa11289ce8a5a42712c0729
ssdeep: 768:ugGzpDGwaFAObGLO6Fh/Zkc6qIMlo6KF27OPna55sxa6jN0EqJMrlwy:LGFCK3x6qIjFFvPLxayNkOr+y
TLSH: T18632BFF350ABED8C3A869B03AEF610592189C74D6032E66059887B6CC57C2BCFE55D70
Submitted as: b7306e_2bfad5332d404dd3b20621e2efe6561e.pdf
File type: pdf · Size: 46564 bytes
Verdict: malicious (78/100)

Detections (2 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ttraff.cc/wix?keyword=minecraft+free+download+apk+java, https://cdn.shopify.com/s/files/1/0431/5856/9128/files/rf_microelectronics_2nd_edition.pdf, https://cdn.shopify.com/s/files/1/0431/7511/6959/files/dabiremediga.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://ttraff.cc/wix?keyword=minecraft+free+download+apk+java
https://cdn.shopify.com/s/files/1/0431/5856/9128/files/rf_microelectronics_2nd_edition.pdf
https://cdn.shopify.com/s/files/1/0431/7511/6959/files/dabiremediga.pdf
https://cdn.shopify.com/s/files/1/0440/9583/2216/files/fidotekeroza.pdf
https://cdn.shopify.com/s/files/1/0432/0778/6654/files/raxerijotolananamidi.pdf
https://cdn.shopify.com/s/files/1/0429/4852/6246/files/fojogaxigil.pdf
https://b33b1fb6-90e7-4ff9-afb9-c284215923f7.filesusr.com/ugd/cf14a4_3f034d65d2c1485b91317e2c7f393f87.pdf?index=true
https://76ca4dfa-7232-44e4-b8cc-4c4c2b98e7f6.filesusr.com/ugd/d2cc1f_25e394e517774dae81c1dda036eb219f.pdf?index=true
https://7b33ca14-1d2e-4d0d-b462-14dedfbc508c.filesusr.com/ugd/45fd81_567d6c81fc7c43c7b00ad98c9bb899e6.pdf?index=true
https://36076e43-c7c3-42ce-af3f-99450bf859fb.filesusr.com/ugd/70e7d4_66999c6d2c244bf6acf8ca58185c6b47.pdf?index=true
https://00696670-bea7-4940-991f-469e970f1dec.filesusr.com/ugd/909b15_6926a30566654e91b33223fdea3b65e1.pdf?index=true
https://789c466c-c195-4660-9c7e-0ace3b13c490.filesusr.com/ugd/e00bd3_1041f4e243e945c285d59869fed9ec09.pdf?index=true
https://6531bc15-dda3-4405-9f59-5e66fa775027.filesusr.com/ugd/69695d_491c06d2477e40b38dad8c7ec78a724f.pdf?index=true
https://94e013ab-5977-448a-b74f-d5c694eb4f2b.filesusr.com/ugd/0d002d_a41eac721cd84f46b9457122d10565d6.pdf?index=true
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ttraff.cc
cdn.shopify.com
b33b1fb6-90e7-4ff9-afb9-c284215923f7.filesusr.com
76ca4dfa-7232-44e4-b8cc-4c4c2b98e7f6.filesusr.com
7b33ca14-1d2e-4d0d-b462-14dedfbc508c.filesusr.com
36076e43-c7c3-42ce-af3f-99450bf859fb.filesusr.com
00696670-bea7-4940-991f-469e970f1dec.filesusr.com
789c466c-c195-4660-9c7e-0ace3b13c490.filesusr.com
6531bc15-dda3-4405-9f59-5e66fa775027.filesusr.com
94e013ab-5977-448a-b74f-d5c694eb4f2b.filesusr.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report