MALICIOUS — d2751c_f3550c1d97d741f695784cbc59a21599.pdf

MALICIOUS — d2751c_f3550c1d97d741f695784cbc59a21599.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 50ad432539d36085d738455daaab34b069caf9928ccfd23a2133e553f9432d68
• SHA-1: 4e8d724fbd308c6aceb87914af4f4e9a470b0809
• MD5: dcf953235ca9cf26dd3068577a72b304
• ssdeep: 768:wWgGzpD3+xza7kbtjrCo59lBz/8C4eLw/nzSN8KdUnwumwM+v420nt2GFQ06YT:SGF7BEvLBD8C4IwfWAwuO+v4ZntPQ06k
• TLSH: T19D31BFF3115BED8C1F829B13A9A610406185DA8C7032AA7449DE7B7DC47C6FCBE65860
• Submitted as: d2751c_f3550c1d97d741f695784cbc59a21599.pdf
• File type: pdf · Size: 40109 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=what+you+eat+is+your+business+they+say, https://19514169-372c-4ff4-9fad-b128c140bedf.filesusr.com/ugd/c5d40f_71fb0b46bcff4b558af3076eaba2ef33.pdf?index=true, https://7265a101-a663-4bd2-ac10-7d52bfb80064.filesusr.com/ugd/35c6e2_00e9a7fac260470fac6bb1d0566fac98.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=what+you+eat+is+your+business+they+say
• https://19514169-372c-4ff4-9fad-b128c140bedf.filesusr.com/ugd/c5d40f_71fb0b46bcff4b558af3076eaba2ef33.pdf?index=true
• https://7265a101-a663-4bd2-ac10-7d52bfb80064.filesusr.com/ugd/35c6e2_00e9a7fac260470fac6bb1d0566fac98.pdf?index=true
• https://ed3bc789-fc7f-4b31-8c3f-07ec22f249fd.filesusr.com/ugd/35f767_b53e4014595b441f8a1360d90189a71e.pdf?index=true
• https://cdn.shopify.com/s/files/1/0431/8583/2096/files/zuxilavewomifexurika.pdf
• https://cdn.shopify.com/s/files/1/0431/2596/4949/files/courtenay_weather_report.pdf
• https://cdn.shopify.com/s/files/1/0433/4649/3605/files/renodajiwurudoseramoxesa.pdf
• https://cdn.shopify.com/s/files/1/0439/3605/5454/files/coa_study_guide.pdf
• https://cdn.shopify.com/s/files/1/0433/7369/1045/files/dungeons_and_dragons_4e.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• 19514169-372c-4ff4-9fad-b128c140bedf.filesusr.com
• 7265a101-a663-4bd2-ac10-7d52bfb80064.filesusr.com
• ed3bc789-fc7f-4b31-8c3f-07ec22f249fd.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report