MALICIOUS — 2d1648_39d88d73617e4c579753579a5190622c.pdf

MALICIOUS — 2d1648_39d88d73617e4c579753579a5190622c.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 54 detection engines flagged it.

Identification

SHA-256: 4c80333ce1782058cff971967bf2db8e2bf99083a27a6dadeb05130ed6df8683
SHA-1: 1e51c549c11c675d647a3ff8b420746e37c1e286
MD5: 0d598ee4c9a5b3d48f8a892996d25c09
ssdeep: 768:4gGzpDJo1xMNPWewvM7N4jSWngWqExgLuvlQ8krsLcgHgWF21m/yFpLUuFwiJIjB:VGFF9G4WgWxqK28pcg6bNxJIj8S
TLSH: T12B33BFF350B3DD8C6ADEAF53AACA11197051C3CD2033A6A458D8366CC4787FE6E50A61
Submitted as: 2d1648_39d88d73617e4c579753579a5190622c.pdf
File type: pdf · Size: 50068 bytes
Verdict: malicious (78/100)

Detections (2 of 54 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ttraff.link/wix?keyword=minecraft+parody+music+playlist, https://cdn.shopify.com/s/files/1/0482/1313/1418/files/87547426594.pdf, https://cdn.shopify.com/s/files/1/0428/9835/8432/files/xekugoxozeritazol.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://ttraff.link/wix?keyword=minecraft+parody+music+playlist
https://cdn.shopify.com/s/files/1/0482/1313/1418/files/87547426594.pdf
https://cdn.shopify.com/s/files/1/0428/9835/8432/files/xekugoxozeritazol.pdf
https://cdn.shopify.com/s/files/1/0461/1476/7012/files/best_attacking_formations_in_football.pdf
https://cdn.shopify.com/s/files/1/0427/6974/4028/files/xaradi.pdf
https://cdn.shopify.com/s/files/1/0433/0687/7080/files/61927850068.pdf
https://34d52dcd-5e66-41f3-bed3-26a819371c8e.filesusr.com/ugd/696117_f8bc3af99f2e42cda53e9b90d832d7c4.pdf?index=true
https://02969fbf-311a-4769-bdf3-60a03c8e71f7.filesusr.com/ugd/681527_bcf7ecb3899a4bb1a0dfd0e9340e13bf.pdf?index=true
https://928786c5-af1b-4af9-bdbf-dd3b09d60fc3.filesusr.com/ugd/ca32a8_bb9f1d840a36436091d810a692d22cd5.pdf?index=true
https://e07e21cc-a202-4e4c-9020-f7b3c513dee8.filesusr.com/ugd/97634b_3a00c2ceb4f945a0bf6989ec7aa25b73.pdf?index=true
https://42668050-351e-4ede-9e29-d9e91a56cb55.filesusr.com/ugd/8a4248_70c581cc6bf54636b6cd17c4a6507a4f.pdf?index=true
https://1661da76-d779-499a-a3e0-f2f20cadc51e.filesusr.com/ugd/3d0627_3f397b275ac9470a8c43421837208fc9.pdf?index=true
https://54a147dc-496f-41d2-ac9c-92f8fc54bf32.filesusr.com/ugd/2e4eb4_014af4a049f84f0aafedcd75c2a970de.pdf?index=true
https://f604524c-dc59-4a9e-abfe-86fc68d5d3bf.filesusr.com/ugd/229b11_fc14f77ce78749d2ab6968663000ccfd.pdf?index=true
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ttraff.link
cdn.shopify.com
34d52dcd-5e66-41f3-bed3-26a819371c8e.filesusr.com
02969fbf-311a-4769-bdf3-60a03c8e71f7.filesusr.com
928786c5-af1b-4af9-bdbf-dd3b09d60fc3.filesusr.com
e07e21cc-a202-4e4c-9020-f7b3c513dee8.filesusr.com
42668050-351e-4ede-9e29-d9e91a56cb55.filesusr.com
1661da76-d779-499a-a3e0-f2f20cadc51e.filesusr.com
54a147dc-496f-41d2-ac9c-92f8fc54bf32.filesusr.com
f604524c-dc59-4a9e-abfe-86fc68d5d3bf.filesusr.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report