MALICIOUS — 5f5755_6d2d8437e4ee434baec44c3b0d278532.pdf

MALICIOUS — 5f5755_6d2d8437e4ee434baec44c3b0d278532.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 2857f0fd526fc5a13d4d72679d4e4accc4a1f1cd325c9ea2ba070717ddc6aaca
• SHA-1: 59a5bba9d034efc52f08f6ed8f91c26187d2e42b
• MD5: 78025c306366e4965f5dae5ca246e90e
• ssdeep: 768:PgGzpDs78lls/rw+fAlVeG5Xb6cn98FS/VnD9l:4GFQ7A9b6cCS1D9l
• TLSH: T132319DF3A097CD8C3A8A9F03B9B514489545DA4C21729AA449CC777CC87C76CAE60AB1
• Submitted as: 5f5755_6d2d8437e4ee434baec44c3b0d278532.pdf
• File type: pdf · Size: 39762 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=gsus%252Fb+guitar+chord, https://f729972b-acd5-460f-9cd0-2d52a86a0e77.filesusr.com/ugd/ab059d_870f41c5ef7f4e6da2a79731db3dac96.pdf?index=true, https://747d921d-58f3-440f-b957-8d6fa7bb2489.filesusr.com/ugd/268ab1_16596155cef74103b5d6fcf4ebacddf8.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=gsus%252Fb+guitar+chord
• https://f729972b-acd5-460f-9cd0-2d52a86a0e77.filesusr.com/ugd/ab059d_870f41c5ef7f4e6da2a79731db3dac96.pdf?index=true
• https://747d921d-58f3-440f-b957-8d6fa7bb2489.filesusr.com/ugd/268ab1_16596155cef74103b5d6fcf4ebacddf8.pdf?index=true
• https://315b1b77-d0dc-4968-9afb-2c8d4bfc7e3b.filesusr.com/ugd/4b874d_df98042170954bda8cba6999418f0fbc.pdf?index=true
• https://57b8a1a4-126d-42b8-993a-210bcab66b53.filesusr.com/ugd/0286dd_fec74bef23bb4313a168a07cefafba55.pdf?index=true
• https://cdn.shopify.com/s/files/1/0430/7864/7957/files/illinois_rules_of_the_road_study_guide.pdf
• https://cdn.shopify.com/s/files/1/0430/5901/9933/files/benim_hocam_corafya_genel_tekrar_2020.pdf
• https://cdn.shopify.com/s/files/1/0429/8339/1395/files/alosol_spray_pediatrico.pdf
• https://cdn.shopify.com/s/files/1/0431/6381/2002/files/exercicios_analise_combinatoria_com_gabarito.pdf
• https://cdn.shopify.com/s/files/1/0433/0268/2789/files/7537853914.pdf
• https://80ff6853-2d13-4cf6-aeb6-96f5e3777ba8.filesusr.com/ugd/9c0842_d39f7d60a6d94bab8502adfa9ab8072d.pdf?index=true
• https://a24c2194-f9ad-4df6-a984-4640697db635.filesusr.com/ugd/0010c8_ee5d24ffa4cc4941ba54ed6b4a361147.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• f729972b-acd5-460f-9cd0-2d52a86a0e77.filesusr.com
• 747d921d-58f3-440f-b957-8d6fa7bb2489.filesusr.com
• 315b1b77-d0dc-4968-9afb-2c8d4bfc7e3b.filesusr.com
• 57b8a1a4-126d-42b8-993a-210bcab66b53.filesusr.com
• cdn.shopify.com
• 80ff6853-2d13-4cf6-aeb6-96f5e3777ba8.filesusr.com
• a24c2194-f9ad-4df6-a984-4640697db635.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report