MALICIOUS — 724fb5_f1a697a31c674fc58c228866c6cc1657.pdf

MALICIOUS — 724fb5_f1a697a31c674fc58c228866c6cc1657.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 29ddb80eda6f595e25c2baa6341ff9d94ab63ae3bb56a67c9b69e0aeb1cc03d7
• SHA-1: 3dcf87c02993d2c6b1bc2e1b947eeac20e93c2ac
• MD5: 34a91fa1112ea764a734a7f718bf5dbf
• ssdeep: 768:ZgGzpDq6kg3BMEIbPbVaDINii6tMEbmTi2gwluKpBzS8q7yhhJUkczBiN/J4HbN:aGFGmBw0DINmtMESZzS8hhb/J47N
• TLSH: T1D033AFF34097ED8C7A4B9B43AEFF115D2049DA896033A79019883B2CD47C6BD6F10A55
• Submitted as: 724fb5_f1a697a31c674fc58c228866c6cc1657.pdf
• File type: pdf · Size: 48894 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=brain+evolution+system+vs+zen12, https://55725ac1-b77c-48a4-b6e1-a2102a70c4b5.filesusr.com/ugd/73c254_9526ceae608244c5a9789cfe1c3cb7db.pdf?index=true, https://d5e62690-e798-4fed-9b85-350444892890.filesusr.com/ugd/3ed902_9da234fbab54422397cc751ae36fdc96.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=brain+evolution+system+vs+zen12
• https://55725ac1-b77c-48a4-b6e1-a2102a70c4b5.filesusr.com/ugd/73c254_9526ceae608244c5a9789cfe1c3cb7db.pdf?index=true
• https://d5e62690-e798-4fed-9b85-350444892890.filesusr.com/ugd/3ed902_9da234fbab54422397cc751ae36fdc96.pdf?index=true
• https://2a6d2756-33be-485a-8f7c-830f3f5f54f3.filesusr.com/ugd/3f80ec_868ae35c811e432ebd4dc3c80a550085.pdf?index=true
• https://352400b8-3fc4-4bab-92f3-33160cf332cb.filesusr.com/ugd/60e703_bf84124401954d51a54a85a6622ace1b.pdf?index=true
• https://59adf9db-3a38-44a0-b2f2-7814e37cd020.filesusr.com/ugd/625844_da0eb2ec45674a26ba2268267aa9b82f.pdf?index=true
• https://4ac13932-8e94-48e2-a764-93cb20da93f7.filesusr.com/ugd/ac8c68_7b18468b82f34977a88fd1bb239e2170.pdf?index=true
• https://9cca4542-59e3-4594-96ea-527a4bfb66ae.filesusr.com/ugd/29c71c_a01274183bf84a3ebeed78bab7de84ad.pdf?index=true
• https://cf22f4f4-0b20-44f1-80f7-20d8885a34b8.filesusr.com/ugd/3f80ec_d4dc942ed53c4463bd15b069d3c6ca3d.pdf?index=true
• https://3afe305c-1862-45aa-a6cb-b454a09428d1.filesusr.com/ugd/8db125_358030f7fe9c402d8c15a38284fec759.pdf?index=true
• https://7be3e62c-5a93-4b21-9b68-c93582bbf1ea.filesusr.com/ugd/665c20_04ddeb6392624c94956d1ac683d9dee6.pdf?index=true
• https://cdn.shopify.com/s/files/1/0431/4998/3905/files/83643020300.pdf
• https://cdn.shopify.com/s/files/1/0482/2276/5210/files/31848916827.pdf
• https://cdn.shopify.com/s/files/1/0436/6965/1606/files/brennenstuhl_timer_user_manual.pdf
• https://cdn.shopify.com/s/files/1/0434/8870/6717/files/19607164172.pdf
• https://cdn.shopify.com/s/files/1/0444/6437/3927/files/riwexaperezafuzemiba.pdf
• https://cdn.shopify.com/s/files/1/0432/0234/7168/files/kipatunukivuvupi.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• 55725ac1-b77c-48a4-b6e1-a2102a70c4b5.filesusr.com
• d5e62690-e798-4fed-9b85-350444892890.filesusr.com
• 2a6d2756-33be-485a-8f7c-830f3f5f54f3.filesusr.com
• 352400b8-3fc4-4bab-92f3-33160cf332cb.filesusr.com
• 59adf9db-3a38-44a0-b2f2-7814e37cd020.filesusr.com
• 4ac13932-8e94-48e2-a764-93cb20da93f7.filesusr.com
• 9cca4542-59e3-4594-96ea-527a4bfb66ae.filesusr.com
• cf22f4f4-0b20-44f1-80f7-20d8885a34b8.filesusr.com
• 3afe305c-1862-45aa-a6cb-b454a09428d1.filesusr.com
• 7be3e62c-5a93-4b21-9b68-c93582bbf1ea.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report