MALICIOUS — e3325f_75395821e9a54a24ade75e36eff3fb07.pdf

MALICIOUS — e3325f_75395821e9a54a24ade75e36eff3fb07.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 54 detection engines flagged it.

Identification

• SHA-256: 60ce51207159228c56d329afe1317dd8d8e5b93f898f2c6659530a985128125e
• SHA-1: b59b7cf4028a2ddde96f338e13ec9ca8898a05cf
• MD5: cfd94a39c15bded31a1820d651fa4ba9
• ssdeep: 768:qgGzpDtamfzU99lXVCjH5f1oEUb3Ei6RnjITwgOHUkebC160RclpN8:3GFxbglytuEUwiijIsgOHUkV6gclpN8
• TLSH: T12632AEF364DBEC8C7A8A5B075ED611692089C28D6233A67045E8776CE0BC5FDAE10D31
• Submitted as: e3325f_75395821e9a54a24ade75e36eff3fb07.pdf
• File type: pdf · Size: 45057 bytes
• Verdict: malicious (78/100)

Detections (2 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=ergometrics+fireteam+study+guide, https://ebebab84-296f-41a3-b94a-22b37b10318b.filesusr.com/ugd/8a05ec_76522f01a7e649ce909db33d4845a746.pdf?index=true, https://6042a6d3-bc8e-4aa9-94ac-cfc9c869ad1f.filesusr.com/ugd/86319b_044c565b7ec749f29432b41928c0d4ae.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=ergometrics+fireteam+study+guide
• https://ebebab84-296f-41a3-b94a-22b37b10318b.filesusr.com/ugd/8a05ec_76522f01a7e649ce909db33d4845a746.pdf?index=true
• https://6042a6d3-bc8e-4aa9-94ac-cfc9c869ad1f.filesusr.com/ugd/86319b_044c565b7ec749f29432b41928c0d4ae.pdf?index=true
• https://18bf85b6-868f-4c40-865f-f66186518dc4.filesusr.com/ugd/3f80ec_781e29472b4e4627918b4fcbc1d8d3cb.pdf?index=true
• https://4c3736d9-92be-41d0-92db-d544ec572970.filesusr.com/ugd/469aea_786ed8fce997470aa57dab1c2e3d5ef1.pdf?index=true
• https://a3015150-2020-4696-ba2e-d12ffbd10f83.filesusr.com/ugd/b148e5_c54d239e4cbd46a9b6f2f971b74ec29d.pdf?index=true
• https://066bd54f-d96a-4d44-8956-35f466939e53.filesusr.com/ugd/9d869b_fc74d2eedbf049f5b386ca3f5683bde8.pdf?index=true
• https://74ba4492-4789-43e1-aed7-3b1c7dd4f8ad.filesusr.com/ugd/7ef0dc_9738ad38781e4f9d9264904ff7eb33a6.pdf?index=true
• https://822ec920-8b91-4153-81d0-cc7c296a8212.filesusr.com/ugd/031dda_91f9f9fec6374f369ea5492e79c2fc15.pdf?index=true
• https://b5dc07c0-e7e9-4d57-8e9e-cfa0433932b4.filesusr.com/ugd/6cabbb_9e04a11a021e4aa8a46cb0710117cead.pdf?index=true
• https://7d55ab2e-7f39-47c2-acc4-28c25295e08b.filesusr.com/ugd/3402b1_6140bd1196aa4c62aca674f6f0edfd6a.pdf?index=true
• https://1d6ae04f-45b4-4123-80a7-5e84df0bcaf2.filesusr.com/ugd/ed2d23_26d09b7982754b89a05e9c479f5b04a2.pdf?index=true
• https://6005bf7a-db45-4088-8cf3-497ad5a42d5b.filesusr.com/ugd/0cd019_0adf2a324b4a44dda790ec5c9d7fbe51.pdf?index=true
• https://cce26f99-4045-4818-9c58-10d02d5a12ad.filesusr.com/ugd/2c8d66_2e0d796412fa4d85b2297afff22a9283.pdf?index=true
• https://4c1b8f6f-d897-428a-ad30-4823a03561d4.filesusr.com/ugd/9c8fb9_cad6a33ef8c6403d9fe4a005754b468c.pdf?index=true
• https://3a39957e-1cdc-4dcc-9a43-7afff9147583.filesusr.com/ugd/e1c37d_e7a880c872b445b1a79c94f53b8c57b9.pdf?index=true
• https://81d98d98-c708-4829-93b5-1411af7a915a.filesusr.com/ugd/269bb8_ed519abb6c4440e39781194813651ee8.pdf?index=true
• https://bf40ee76-d573-452d-ad7f-6c5d5f6533c5.filesusr.com/ugd/8c0e65_799e51a3fa184dd4a79e639d6321dbf1.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• ebebab84-296f-41a3-b94a-22b37b10318b.filesusr.com
• 6042a6d3-bc8e-4aa9-94ac-cfc9c869ad1f.filesusr.com
• 18bf85b6-868f-4c40-865f-f66186518dc4.filesusr.com
• 4c3736d9-92be-41d0-92db-d544ec572970.filesusr.com
• a3015150-2020-4696-ba2e-d12ffbd10f83.filesusr.com
• 066bd54f-d96a-4d44-8956-35f466939e53.filesusr.com
• 74ba4492-4789-43e1-aed7-3b1c7dd4f8ad.filesusr.com
• 822ec920-8b91-4153-81d0-cc7c296a8212.filesusr.com
• b5dc07c0-e7e9-4d57-8e9e-cfa0433932b4.filesusr.com
• 7d55ab2e-7f39-47c2-acc4-28c25295e08b.filesusr.com
• 1d6ae04f-45b4-4123-80a7-5e84df0bcaf2.filesusr.com
• 6005bf7a-db45-4088-8cf3-497ad5a42d5b.filesusr.com
• cce26f99-4045-4818-9c58-10d02d5a12ad.filesusr.com
• 4c1b8f6f-d897-428a-ad30-4823a03561d4.filesusr.com
• 3a39957e-1cdc-4dcc-9a43-7afff9147583.filesusr.com
• 81d98d98-c708-4829-93b5-1411af7a915a.filesusr.com
• bf40ee76-d573-452d-ad7f-6c5d5f6533c5.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report