MALICIOUS — 417718_d873af4452ad43ba9fa223391e78ab83.pdf

MALICIOUS — 417718_d873af4452ad43ba9fa223391e78ab83.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 500a6bcf87cdd50b6efb0cec1615f864656cbf2f57f3287564d343d2acb5aaf6
• SHA-1: 2c7274fb1e713db791a7c3656ab8bd881ee4cd1a
• MD5: 9bd9ea6c30a6af57074b868c122d3d1e
• ssdeep: 768:xgGzpDAFleqgeqCd6dbE0jhs6ljeHijqm/P90zC8v:CGF0F/6dwchs6l7/P90zC8v
• TLSH: T1902F8DF3509BDD8C3986AB036EDE14486186D78DA173A63085EC376CC4BC2BD6F41A60
• Submitted as: 417718_d873af4452ad43ba9fa223391e78ab83.pdf
• File type: pdf · Size: 33657 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=panasonic+viera+50+plasma+1080p+manual, https://ac7b54f7-bb71-4462-ba45-881279158d61.filesusr.com/ugd/2486b5_bb6f405ff42e43ad83998d3c11a7b324.pdf?index=true, https://5fcb74a1-8cdd-4175-9636-a232d59f9bda.filesusr.com/ugd/185811_a428a0e1b94b4e27aa2c03063ba35fcc.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=panasonic+viera+50+plasma+1080p+manual
• https://ac7b54f7-bb71-4462-ba45-881279158d61.filesusr.com/ugd/2486b5_bb6f405ff42e43ad83998d3c11a7b324.pdf?index=true
• https://5fcb74a1-8cdd-4175-9636-a232d59f9bda.filesusr.com/ugd/185811_a428a0e1b94b4e27aa2c03063ba35fcc.pdf?index=true
• https://a8473b5a-179e-4a62-8a71-c5362cf825da.filesusr.com/ugd/9ff9b8_9747cfe724db48c98f0227a6dff31316.pdf?index=true
• https://a7b02eda-7723-4983-8a29-abe2d7c398ec.filesusr.com/ugd/89441e_7ce58d78807f4864b436bb84994a1fe5.pdf?index=true
• https://b991fe70-645b-456e-9494-a877e634d717.filesusr.com/ugd/1e52da_c48ddd1b036142679ef04e3d27cbbc43.pdf?index=true
• http://files.txgrandma.com/uploads/1/3/1/6/131607062/640293.pdf
• https://cdn.shopify.com/s/files/1/0431/2412/9946/files/corporate_party_invitation_email_template.pdf
• https://cdn.shopify.com/s/files/1/0433/9597/3276/files/47959372702.pdf
• https://a9c6613e-e286-440f-bc47-b2c1e208c91b.filesusr.com/ugd/3225da_179be032197740a1a4516daacca53f0b.pdf?index=true
• https://ea16d45c-a31f-46ec-a677-f1eb811231ba.filesusr.com/ugd/1d64af_de55a82a2aac4e8d8e7cea1321d8250b.pdf?index=true
• https://03a56b6b-8945-4ae2-8069-d39848c6ecf1.filesusr.com/ugd/61f964_66ba84e1fd504204b19f52bb93c89b57.pdf?index=true
• https://3838911d-3cc2-4f6c-9d3e-f75ce5704dcf.filesusr.com/ugd/61c57f_dfb83b9b24e14ee883da2a2fd69047b6.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• ac7b54f7-bb71-4462-ba45-881279158d61.filesusr.com
• 5fcb74a1-8cdd-4175-9636-a232d59f9bda.filesusr.com
• a8473b5a-179e-4a62-8a71-c5362cf825da.filesusr.com
• a7b02eda-7723-4983-8a29-abe2d7c398ec.filesusr.com
• b991fe70-645b-456e-9494-a877e634d717.filesusr.com
• files.txgrandma.com
• cdn.shopify.com
• a9c6613e-e286-440f-bc47-b2c1e208c91b.filesusr.com
• ea16d45c-a31f-46ec-a677-f1eb811231ba.filesusr.com
• 03a56b6b-8945-4ae2-8069-d39848c6ecf1.filesusr.com
• 3838911d-3cc2-4f6c-9d3e-f75ce5704dcf.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report