MALICIOUS — 269bb8_8d119141d7db47dbba0e2fa6f526e016.pdf

MALICIOUS — 269bb8_8d119141d7db47dbba0e2fa6f526e016.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

SHA-256: 5001c3859b31ac8ed69a2c383a5e0a2a102476a180990b3f723de7918acae243
SHA-1: fdf92ffff6d2470d46f2e7dc7e2a6b7ef274511d
MD5: 16b460246e3cfda5fc17b5390ea53cde
ssdeep: 768:ZgGzpD5WBHFer7UcjVNXpbKhgPdet0jwqCR4Y/Tr8qOTNyzHt:aGF1sSbKqbTY/TrTuyzHt
TLSH: T1AD328DF3007BEE8C7A8AEB4368E61495B059CBC87132977048C8762CD97C7BC6E51961
Submitted as: 269bb8_8d119141d7db47dbba0e2fa6f526e016.pdf
File type: pdf · Size: 43684 bytes
Verdict: malicious (88/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ttraff.ru/wix?keyword=schon+flooring+where+to+buy, https://cdn.shopify.com/s/files/1/0438/4201/1286/files/rikinalopepadivudazavuni.pdf, https://cdn.shopify.com/s/files/1/0434/3093/6732/files/60592992930.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://ttraff.ru/wix?keyword=schon+flooring+where+to+buy
https://cdn.shopify.com/s/files/1/0438/4201/1286/files/rikinalopepadivudazavuni.pdf
https://cdn.shopify.com/s/files/1/0434/3093/6732/files/60592992930.pdf
https://cdn.shopify.com/s/files/1/0433/4184/0535/files/64534832935.pdf
https://cdn.shopify.com/s/files/1/0433/3237/0590/files/christmas_music.pdf
https://cdn.shopify.com/s/files/1/0434/1219/3438/files/senisixi.pdf
https://cdn.shopify.com/s/files/1/0435/0181/3915/files/sujawefifopefavikotomifi.pdf
https://cdn.shopify.com/s/files/1/0433/5593/0783/files/litozinewumozitaj.pdf
https://cdn.shopify.com/s/files/1/0432/2259/7796/files/77104860735.pdf
https://395e30b0-0de4-412a-81b2-460036425462.filesusr.com/ugd/451a43_dc10443c55b34084a047fb8ffd7fbf19.pdf?index=true
https://26fdc8cc-094c-436f-930f-211c93324804.filesusr.com/ugd/938c70_a09db7811fc54066b4e4a1cc73cbb139.pdf?index=true
https://c3f274b6-26a9-4a67-98a1-078f001dcb8e.filesusr.com/ugd/43d2fc_a9279f5c567b42869bb66dc201662dbf.pdf?index=true
https://c378bfa7-b99f-44d5-aa1b-7e92ea228af5.filesusr.com/ugd/8e6e76_653fb381c40f4ee6b31d6cae46d0fc3d.pdf?index=true
https://074845b9-09c9-4e49-88f3-9cd3027ece61.filesusr.com/ugd/938c70_dc8d16f41db94fce9441e99269c8a84a.pdf?index=true
https://ed3f8539-a366-46f1-b920-9457e61a262e.filesusr.com/ugd/384ea4_9aa08dd9bb6742ac8985b563a8c93230.pdf?index=true
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ttraff.ru
cdn.shopify.com
395e30b0-0de4-412a-81b2-460036425462.filesusr.com
26fdc8cc-094c-436f-930f-211c93324804.filesusr.com
c3f274b6-26a9-4a67-98a1-078f001dcb8e.filesusr.com
c378bfa7-b99f-44d5-aa1b-7e92ea228af5.filesusr.com
074845b9-09c9-4e49-88f3-9cd3027ece61.filesusr.com
ed3f8539-a366-46f1-b920-9457e61a262e.filesusr.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report