MALICIOUS — ea2f88_58310a4e54164e25b87b74d52f71bc8a.pdf

MALICIOUS — ea2f88_58310a4e54164e25b87b74d52f71bc8a.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 31d336fb8e7bcff2d896866f8e0b83e6f042ce354750fa4c20b2a750464b52bb
• SHA-1: f693298988c7fc427394d4f3b8d8264e9671fbf6
• MD5: ca9ae371be6c1f0bf85ed0d6de18048b
• ssdeep: 768:mgGzpDL854hmZJRetkvdNmVCovIq0qdlwtEj94ywLv5kwiuHKvKGEg1VZ3plp7+5:zGF385aMoASOEBq5pPKvKG/1rB7+hGva
• TLSH: T18D33BEF35097EC8D7ACA6B079EBA1168A085C74D3136966045D87B3CC07CAFDAF50A21
• Submitted as: ea2f88_58310a4e54164e25b87b74d52f71bc8a.pdf
• File type: pdf · Size: 48835 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=krillin+dbz+height, https://4815d637-cd69-40cf-985d-964ffdbc0c6f.filesusr.com/ugd/185811_b98cb6a79df341f180ae0a1108984123.pdf?index=true, https://a6c1b372-a7e7-48af-bdf8-c6830b879c2a.filesusr.com/ugd/48bf55_510a56eb3def4eb18057b1b686566a8b.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=krillin+dbz+height
• https://4815d637-cd69-40cf-985d-964ffdbc0c6f.filesusr.com/ugd/185811_b98cb6a79df341f180ae0a1108984123.pdf?index=true
• https://a6c1b372-a7e7-48af-bdf8-c6830b879c2a.filesusr.com/ugd/48bf55_510a56eb3def4eb18057b1b686566a8b.pdf?index=true
• https://b0abd5ec-2912-4ad4-abeb-7ab372b20454.filesusr.com/ugd/9ea91e_794c179bfccf4b3f97db19f74456035e.pdf?index=true
• https://f457472c-153e-479e-801e-e8b558f45222.filesusr.com/ugd/440e29_7f67a8eb58fc4ee295e492925b91430e.pdf?index=true
• https://e01e050a-a400-48c8-b0e5-88edd0af63d1.filesusr.com/ugd/43d2fc_e167e5a58f464dceb053b586903d8c71.pdf?index=true
• https://cdn.shopify.com/s/files/1/0433/4832/8603/files/bufewilajeme.pdf
• https://cdn.shopify.com/s/files/1/0430/0197/0837/files/93785208011.pdf
• https://cdn.shopify.com/s/files/1/0429/4026/8711/files/vegobatatezokifuzoloriv.pdf
• https://32a7813d-331e-4241-b7c2-caa746d9d9f2.filesusr.com/ugd/9c0842_4623f31d58ba429cbe3a3acc195b70a5.pdf?index=true
• https://05736864-4e47-4f84-9e97-01809fe3fd19.filesusr.com/ugd/a91264_b44acdf288274d3abb5ef869ee512d52.pdf?index=true
• https://d0691845-5102-4412-aa87-3fa162c2ed48.filesusr.com/ugd/cb2bed_4236af4c0c58469ba300d48bae31c324.pdf?index=true
• https://8a892f84-fc96-4baa-8ca5-d835c1f8378c.filesusr.com/ugd/e3325f_2356872449f346b6bec17da9127c2174.pdf?index=true
• https://cdn.shopify.com/s/files/1/0433/2303/1720/files/13949116381.pdf
• https://cdn.shopify.com/s/files/1/0437/3803/8423/files/veluzuzij.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• 4815d637-cd69-40cf-985d-964ffdbc0c6f.filesusr.com
• a6c1b372-a7e7-48af-bdf8-c6830b879c2a.filesusr.com
• b0abd5ec-2912-4ad4-abeb-7ab372b20454.filesusr.com
• f457472c-153e-479e-801e-e8b558f45222.filesusr.com
• e01e050a-a400-48c8-b0e5-88edd0af63d1.filesusr.com
• cdn.shopify.com
• 32a7813d-331e-4241-b7c2-caa746d9d9f2.filesusr.com
• 05736864-4e47-4f84-9e97-01809fe3fd19.filesusr.com
• d0691845-5102-4412-aa87-3fa162c2ed48.filesusr.com
• 8a892f84-fc96-4baa-8ca5-d835c1f8378c.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report