MALICIOUS — fef806_083ce98e012c446288929425469a610c.pdf

MALICIOUS — fef806_083ce98e012c446288929425469a610c.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 54 detection engines flagged it.

Identification

• SHA-256: 39f850d2d28fb53cdb38c4b09a7b444fb2d23bd4b647d622bfcae693adb423dd
• SHA-1: bb2c0fcd9ff91b6be45970ca0be962a8197233f9
• MD5: ea1135208c8d23b36d2ebd4eedcf5efb
• ssdeep: 768:wgGzpDukbuq0t9Xo18uSMR9dwJUUZ81dHHEoBpcDmL:dGF6EdwJMdHHHTcmL
• TLSH: T1DE32AEF38097DC4C7D8AAB53ADE6108A5086E38C6133A77049D87B6DD67C6BCAE44850
• Submitted as: fef806_083ce98e012c446288929425469a610c.pdf
• File type: pdf · Size: 44528 bytes
• Verdict: malicious (78/100)

Detections (2 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=baixaki+jogos+online, https://cdn.shopify.com/s/files/1/0429/9977/5385/files/nova_legacy_mod_apk_happymod.pdf, https://cdn.shopify.com/s/files/1/0433/9944/6693/files/biology_books_online.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=baixaki+jogos+online
• https://cdn.shopify.com/s/files/1/0429/9977/5385/files/nova_legacy_mod_apk_happymod.pdf
• https://cdn.shopify.com/s/files/1/0433/9944/6693/files/biology_books_online.pdf
• https://cdn.shopify.com/s/files/1/0430/4915/6757/files/bomberman_multiplayer_offline_apk.pdf
• https://cdn.shopify.com/s/files/1/0435/3599/0936/files/52194363950.pdf
• https://cdn.shopify.com/s/files/1/0431/4556/0225/files/niwepimajul.pdf
• https://cdn.shopify.com/s/files/1/0432/8413/6086/files/australian_citizenship_form_1300t.pdf
• https://cdn.shopify.com/s/files/1/0430/2100/9053/files/siesta_key_beach_report_today.pdf
• https://cdn.shopify.com/s/files/1/0429/9302/5187/files/28545503837.pdf
• https://cdn.shopify.com/s/files/1/0432/4907/4336/files/zulububizaneruvuf.pdf
• https://cdn.shopify.com/s/files/1/0433/8991/1196/files/13580783622.pdf
• https://1c2ccaaf-83b1-4574-b77e-0ec4dccaaa6e.filesusr.com/ugd/7ef0dc_6db80e884c9046d7915fcafee4640f94.pdf?index=true
• https://4a3dccd4-b360-428e-ba0a-68b995ea3408.filesusr.com/ugd/eaf48f_25060061a4374736b4af5da208359ab7.pdf?index=true
• https://6a093f5d-3bba-469a-802a-763cc7df7b64.filesusr.com/ugd/163759_969360a4e634445b9ed9e3ee7661f16f.pdf?index=true
• https://70405aab-1ada-40c4-b527-f958584bceff.filesusr.com/ugd/72b0e7_a70bc8fa402d4e2f9c2d726b67f40eca.pdf?index=true
• https://3ffb5109-9bfa-4b6d-bf40-7a88141a0b00.filesusr.com/ugd/1be480_252da6b54c38488fa41b292b7e17f48f.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• cdn.shopify.com
• 1c2ccaaf-83b1-4574-b77e-0ec4dccaaa6e.filesusr.com
• 4a3dccd4-b360-428e-ba0a-68b995ea3408.filesusr.com
• 6a093f5d-3bba-469a-802a-763cc7df7b64.filesusr.com
• 70405aab-1ada-40c4-b527-f958584bceff.filesusr.com
• 3ffb5109-9bfa-4b6d-bf40-7a88141a0b00.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report