MALICIOUS — 80bfa9_3dc890e4a8fb45c29741909f67647a49.pdf

MALICIOUS — 80bfa9_3dc890e4a8fb45c29741909f67647a49.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 295fa242c378755b97e2c76d8a5e23b3c1c88011fcc6055f78c25b12fe3f8177
• SHA-1: 28c245a9e9d82a502e83a282c1c1b9e96b80c9e1
• MD5: d65ede0a9791c35dfb34fc45d408af0b
• ssdeep: 768:6gGzpDi/kPTLuBlCz/EWQX1NTbXch3D2JUR++9U:nGF2q8WODbXSD2mlU
• TLSH: T1692F9EF324ABEC4C7A82AB031AF615065149C78C7137D7741898373CC8BC2AD6F41A61
• Submitted as: 80bfa9_3dc890e4a8fb45c29741909f67647a49.pdf
• File type: pdf · Size: 33076 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=troy+bilt+2550+pressure+washer+manual, http://files.alittlelively.com/uploads/1/3/1/6/131636644/5888767.pdf, http://files.davidrsmithbooks.com/uploads/1/3/0/8/130815137/bubafedugoz_gebevexi_jezewukos_jifawer.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=troy+bilt+2550+pressure+washer+manual
• http://files.alittlelively.com/uploads/1/3/1/6/131636644/5888767.pdf
• http://files.davidrsmithbooks.com/uploads/1/3/0/8/130815137/bubafedugoz_gebevexi_jezewukos_jifawer.pdf
• http://tokusowa.remycenard.com/uploads/1/3/2/8/132814930/6fe029f5.pdf
• https://cdn.shopify.com/s/files/1/0430/4021/1105/files/11745630653.pdf
• http://files.hopecurlingclub.com/uploads/1/3/0/7/130739596/1ed2822f0878f.pdf
• http://ranev.sarahleavittlpc.com/uploads/1/3/0/8/130874063/5548568.pdf
• http://files.concordiaball.at/uploads/1/3/2/7/132741535/lapevegowawidaz_supetarixamatel_sijizeratodijan_nobibe.pdf
• https://cdn.shopify.com/s/files/1/0437/6464/6040/files/78097478068.pdf
• https://cdn.shopify.com/s/files/1/0434/4106/2055/files/mozetilovizubofuriteriv.pdf
• https://cdn.shopify.com/s/files/1/0432/8144/9118/files/rezinepegusutori.pdf
• https://cdn.shopify.com/s/files/1/0427/4143/2487/files/57802098423.pdf
• https://cdn.shopify.com/s/files/1/0432/8253/0472/files/purble_place_game_for_pc_free.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• files.alittlelively.com
• files.davidrsmithbooks.com
• tokusowa.remycenard.com
• cdn.shopify.com
• files.hopecurlingclub.com
• ranev.sarahleavittlpc.com
• www.w3.org
• purl.org
• ns.adobe.com
• files.concordiaball.at

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report