MALICIOUS — ccf397_8a88c6cce7d34530a80d8819290b56e5.pdf

MALICIOUS — ccf397_8a88c6cce7d34530a80d8819290b56e5.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 63e019add0691684827ae16204d6959779e323c381a7c33096b1a6dea38dbc4d
• SHA-1: b616e19bb7c5f4770bf42502e843f18cca4da714
• MD5: dbebf3553f57d14b2beb7ad6da62df11
• ssdeep: 768:vgGzpDfHiUIewd+NjeLzBNr0IgxkugKidAfqEad1gGOqCXtH6176+7e:YGFrCL+QN4Ig+uA0qJ1gIY6N6+q
• TLSH: T170328DF30097ECCC7A8AAF17AAA7114D218AD6896133A6A048D9372CD57C5FC7F10661
• Submitted as: ccf397_8a88c6cce7d34530a80d8819290b56e5.pdf
• File type: pdf · Size: 43752 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.PDF.Agent.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.PDF.Agent.gen (rule HEUR:Trojan.PDF.Agent.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=transcribeme+style+guide+answers, https://cdn.shopify.com/s/files/1/0433/4390/4927/files/39147350226.pdf, https://cdn.shopify.com/s/files/1/0435/0722/0644/files/bypass_software_free.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=transcribeme+style+guide+answers
• https://cdn.shopify.com/s/files/1/0437/1926/2363/files/94176269478.pdf
• https://cdn.shopify.com/s/files/1/0433/4390/4927/files/39147350226.pdf
• https://cdn.shopify.com/s/files/1/0435/0722/0644/files/bypass_software_free.pdf
• https://f56d7e54-8638-4bfd-9483-20edb8bb8767.filesusr.com/ugd/c33cdb_b1349f052660475a9fbc5550afce9228.pdf?index=true
• https://591ae14a-7fb2-4180-bef5-d4a35bca6870.filesusr.com/ugd/17ce20_864c3f20a9f041d4b4fbcaba14e3a993.pdf?index=true
• https://66e447ad-f389-41d2-825f-eb234976f17c.filesusr.com/ugd/0789d5_e883720da0f041dcab7d2eab506a2d20.pdf?index=true
• https://80ff6853-2d13-4cf6-aeb6-96f5e3777ba8.filesusr.com/ugd/9c0842_d39f7d60a6d94bab8502adfa9ab8072d.pdf?index=true
• https://ae4cd31c-12f5-445e-a31e-d548442b3911.filesusr.com/ugd/5926b4_6df518d280414e32a983647e7e8910a5.pdf?index=true
• https://6f0c7dd3-8bde-4fe6-ab4d-f8b74598f247.filesusr.com/ugd/0a51c1_f4bb1c0644514c738f418857a59d25c4.pdf?index=true
• https://563474d9-1b91-4b7b-8d7c-f635983aabf9.filesusr.com/ugd/02ccf7_dadb545c8be54754ad99449570b8d8a4.pdf?index=true
• https://7922f628-3d0b-40d8-af9b-0fab3de3c8c9.filesusr.com/ugd/bcc0e4_2658c1015ed24f0cbc4ed4514a31894d.pdf?index=true
• https://92ca2613-608a-47de-b9e6-cded9565c345.filesusr.com/ugd/badafb_51ef8b929b254c23a0d84efd618f89a2.pdf?index=true
• https://cdn.shopify.com/s/files/1/0430/2825/0781/files/76757099434.pdf
• https://cdn.shopify.com/s/files/1/0459/7042/3968/files/fdmc8884_datasheet.pdf
• https://cdn.shopify.com/s/files/1/0428/8721/7311/files/ages_and_stages_questionnaire_5_years.pdf
• https://cdn.shopify.com/s/files/1/0439/2858/4347/files/barsaat_ke_din_aaye_song_320kbps.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• cdn.shopify.com
• f56d7e54-8638-4bfd-9483-20edb8bb8767.filesusr.com
• 591ae14a-7fb2-4180-bef5-d4a35bca6870.filesusr.com
• 66e447ad-f389-41d2-825f-eb234976f17c.filesusr.com
• 80ff6853-2d13-4cf6-aeb6-96f5e3777ba8.filesusr.com
• ae4cd31c-12f5-445e-a31e-d548442b3911.filesusr.com
• 6f0c7dd3-8bde-4fe6-ab4d-f8b74598f247.filesusr.com
• 563474d9-1b91-4b7b-8d7c-f635983aabf9.filesusr.com
• 7922f628-3d0b-40d8-af9b-0fab3de3c8c9.filesusr.com
• 92ca2613-608a-47de-b9e6-cded9565c345.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report