MALICIOUS — edb4a7_f5252230338c4a6593b8d6b692226329.pdf

MALICIOUS — edb4a7_f5252230338c4a6593b8d6b692226329.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 54 detection engines flagged it.

Identification

• SHA-256: 5d0b81aa256c80cf40c42b5f67bb419be98c8aa7643c3efa83219d1533684191
• SHA-1: bb08ee5dea52ec6e5fe659b9da35c20adc2840f8
• MD5: ea6058cabfa017e9f8360cabc5fade88
• ssdeep: 3072:lFJgkdpu2eMkFA7vwOJBRHxSa8M+FXI9R7nvUTdeKnIDGKvU:rddpu2y6HBRHYOQI9R7nv2dei7Kc
• TLSH: T1133DD0F3D08BDDB5B9C51B47BA9658396D4A928860F2973005C826EFF4782BD6F11230
• Submitted as: edb4a7_f5252230338c4a6593b8d6b692226329.pdf
• File type: pdf · Size: 125198 bytes
• Verdict: malicious (78/100)

Detections (2 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=zoll+m+series+manual+de+usuario, https://a2417b83-89bf-4bc7-a5ef-02fd4a819208.filesusr.com/ugd/d8966e_60173ba9f5dc46dfa39539a752d3680f.pdf?index=true, https://950884b1-ffd6-4567-a5e5-00e88a50be52.filesusr.com/ugd/dcc11b_cf0cf3fc05094bcbbc11a53211f151f4.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=zoll+m+series+manual+de+usuario
• https://a2417b83-89bf-4bc7-a5ef-02fd4a819208.filesusr.com/ugd/d8966e_60173ba9f5dc46dfa39539a752d3680f.pdf?index=true
• https://950884b1-ffd6-4567-a5e5-00e88a50be52.filesusr.com/ugd/dcc11b_cf0cf3fc05094bcbbc11a53211f151f4.pdf?index=true
• https://8c8c1669-5b94-4b85-a9ce-f7c5f70c6a29.filesusr.com/ugd/c4dbd3_1126752823ab4aa8af3ef5f1e73bea0f.pdf?index=true
• https://b10d9f71-635b-424d-95b6-a82c8fa03498.filesusr.com/ugd/529dbf_dca699f3c456400eb1ec04ce0d9a9eb6.pdf?index=true
• http://zozibe.kristinamaus.com/uploads/1/3/1/8/131856373/gosamizek-fagil.pdf
• http://files.ncontrack.org/uploads/1/3/1/4/131438366/2447321.pdf
• http://files.76bulbs.com/uploads/1/3/1/3/131382078/jusolapotikage_tovenuzo_gamexo.pdf
• http://files.antiochwaukegan.org/uploads/1/3/1/4/131454766/ff0b9c641a08d.pdf
• http://files.ledandminis.com/uploads/1/3/0/7/130776828/507ffbf0262e0a.pdf
• http://files.sherpasride.com/uploads/1/3/1/3/131379111/1653136.pdf
• http://files.drkathrynkimball.com/uploads/1/3/2/6/132681464/7a76f8f7ff8.pdf
• http://wokixipox.bntarms.com/uploads/1/3/0/8/130814408/wovenimadivu-vulex-wobijarutotuja-damigatovuw.pdf
• http://files.developmentmedia.net/uploads/1/3/1/3/131398100/3251732.pdf
• https://830ee3b0-fdd6-4397-b1f7-b348ab602452.filesusr.com/ugd/53c654_9940915e13374b0da2655c59687cac7f.pdf?index=true
• https://4e3232b2-26d2-4b8e-b8c4-5defc0cc80d1.filesusr.com/ugd/0582e0_9da4980fe846496eb3aa43eb4d9e96ea.pdf?index=true
• https://a53ef0bb-4d7c-494c-9b92-36c76bbab3a9.filesusr.com/ugd/ceb2e8_9181c7ba927a4e5f93521975df44b521.pdf?index=true
• https://d02b4782-e490-4565-a95a-5fdc2521a992.filesusr.com/ugd/5e8de6_4bc468dba7b646cebb7f69a6e2e7e806.pdf?index=true
• https://62624e47-4aee-444b-b139-82de88947081.filesusr.com/ugd/b42fd6_2457d535bfb5432da8dcdb008481b2ba.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• a2417b83-89bf-4bc7-a5ef-02fd4a819208.filesusr.com
• 950884b1-ffd6-4567-a5e5-00e88a50be52.filesusr.com
• 8c8c1669-5b94-4b85-a9ce-f7c5f70c6a29.filesusr.com
• b10d9f71-635b-424d-95b6-a82c8fa03498.filesusr.com
• zozibe.kristinamaus.com
• files.ncontrack.org
• files.76bulbs.com
• files.antiochwaukegan.org
• files.ledandminis.com
• files.sherpasride.com
• files.drkathrynkimball.com
• wokixipox.bntarms.com
• files.developmentmedia.net
• 830ee3b0-fdd6-4397-b1f7-b348ab602452.filesusr.com
• 4e3232b2-26d2-4b8e-b8c4-5defc0cc80d1.filesusr.com
• a53ef0bb-4d7c-494c-9b92-36c76bbab3a9.filesusr.com
• d02b4782-e490-4565-a95a-5fdc2521a992.filesusr.com
• 62624e47-4aee-444b-b139-82de88947081.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

File paths

• f:\_F

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report