MALICIOUS — 34e21e_763893adae91474e8f3baca76fe2686f.pdf

MALICIOUS — 34e21e_763893adae91474e8f3baca76fe2686f.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 489aa4043f19beac7616e34c352ebf163a89b73b6dc219444a825364f3fcd046
• SHA-1: cea50328d359824c4536a4521643f72c1c764eb1
• MD5: 52ec94653b15a09c292556e78016581a
• ssdeep: 768:b1gGzpD/55SV+TvgstrjAORq4PqYW9N6qbUi72dZUCruTWOLqIprH:bmGFbxB/WN6qbupKTWzIprH
• TLSH: T10B33AEF311A7DC4C7A87DF03B9EE292C6185D7896033AA644598376CC0BC6BEAF40654
• Submitted as: 34e21e_763893adae91474e8f3baca76fe2686f.pdf
• File type: pdf · Size: 49606 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=canyon+guide+outfitters+cargo+shorts, https://c21d7675-c2a0-4e57-bbdf-0f6b6eb20f24.filesusr.com/ugd/3e87bf_a7afd74094f34f88839d402bb693349d.pdf?index=true, https://fb55f095-af3c-4161-8d44-8968aa81118c.filesusr.com/ugd/3f1130_55854ada35fb4523b12f673d381d5487.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=canyon+guide+outfitters+cargo+shorts
• https://c21d7675-c2a0-4e57-bbdf-0f6b6eb20f24.filesusr.com/ugd/3e87bf_a7afd74094f34f88839d402bb693349d.pdf?index=true
• https://fb55f095-af3c-4161-8d44-8968aa81118c.filesusr.com/ugd/3f1130_55854ada35fb4523b12f673d381d5487.pdf?index=true
• https://c0fd9646-8574-4953-80a6-5c09f9a92f6a.filesusr.com/ugd/2e4eb4_ffc8963254864c2d8c1fb2ca312b6b29.pdf?index=true
• https://15a38af7-7aed-4ad4-97dd-9b62bae7f06d.filesusr.com/ugd/8e7730_087bd762caec43a6aa0f6944c39e25f9.pdf?index=true
• https://b2e39030-8388-4007-862c-4b2e911e4ae4.filesusr.com/ugd/12745a_d09c538a52fa46b283eccb4c24224f92.pdf?index=true
• https://1c5c794a-123c-42b3-823f-3b23f67f139b.filesusr.com/ugd/d5415a_7d9503463b9641a6b2c6d6c9e56abf49.pdf?index=true
• https://95436cbb-6ba0-40f3-bbf7-3b5b37ff98ca.filesusr.com/ugd/0182ef_4cd773aec1234e169ae048c2c48bc827.pdf?index=true
• https://8af56760-9ee7-4ab2-9814-44ec45e3b986.filesusr.com/ugd/5ea691_27fe9f74a16a4fb8ac859b9863c1f759.pdf?index=true
• https://14aba9b8-8f4f-41fc-a43d-2fb466f93f5b.filesusr.com/ugd/384ea4_b225470e35634fbeacdc45d3c28e3935.pdf?index=true
• https://0eec47ed-6465-435f-a987-e566d74d0991.filesusr.com/ugd/cb2bed_14eced9a1fae47739969f90ff7801695.pdf?index=true
• https://b1a06443-dc07-4643-a86c-09d4828f4fe9.filesusr.com/ugd/594ae5_432048e078f947278954832538d72094.pdf?index=true
• https://7a682457-fdb0-4706-bbd3-61ced659d25b.filesusr.com/ugd/277b62_4426910e79744512a165fdc75b01a232.pdf?index=true
• https://7a2fd1a9-a9b6-4093-8382-7433d048a89c.filesusr.com/ugd/957c7b_418e629eb5ac44d3bdcb61dcad22a897.pdf?index=true
• https://cdn.shopify.com/s/files/1/0430/5806/9655/files/active_and_passive_voice_worksheets_with_answers.pdf
• https://cdn.shopify.com/s/files/1/0482/1883/3048/files/the_nielsen_total_audience_report_q3_2018.pdf
• https://cdn.shopify.com/s/files/1/0438/4302/7106/files/xenophage_quest_steps.pdf
• https://cdn.shopify.com/s/files/1/0463/5607/0561/files/tidemuboxexoziz.pdf
• https://cdn.shopify.com/s/files/1/0428/0962/2687/files/24505353600.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• c21d7675-c2a0-4e57-bbdf-0f6b6eb20f24.filesusr.com
• fb55f095-af3c-4161-8d44-8968aa81118c.filesusr.com
• c0fd9646-8574-4953-80a6-5c09f9a92f6a.filesusr.com
• 15a38af7-7aed-4ad4-97dd-9b62bae7f06d.filesusr.com
• b2e39030-8388-4007-862c-4b2e911e4ae4.filesusr.com
• 1c5c794a-123c-42b3-823f-3b23f67f139b.filesusr.com
• 95436cbb-6ba0-40f3-bbf7-3b5b37ff98ca.filesusr.com
• 8af56760-9ee7-4ab2-9814-44ec45e3b986.filesusr.com
• 14aba9b8-8f4f-41fc-a43d-2fb466f93f5b.filesusr.com
• 0eec47ed-6465-435f-a987-e566d74d0991.filesusr.com
• b1a06443-dc07-4643-a86c-09d4828f4fe9.filesusr.com
• 7a682457-fdb0-4706-bbd3-61ced659d25b.filesusr.com
• 7a2fd1a9-a9b6-4093-8382-7433d048a89c.filesusr.com
• cdn.shopify.com
• 9la.be
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report