MALICIOUS — f80014_68b861bed6e64ed4a601ad515f87f712.pdf

MALICIOUS — f80014_68b861bed6e64ed4a601ad515f87f712.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 670875c462ed20eec0da576ebd752e1d61da01af1112ae6a4a0ee820f253c0f0
• SHA-1: 82f1abbcc07b649d8838cb8c4b730c725aa69aa3
• MD5: e2ab9e43c76503215e4c7070ec796eef
• ssdeep: 768:jgGzpDyQTTb2RErqGByJ9hyxMnq47Zfj2fiH0UtPcy7jj5ymRVvq1tJS:cGF+NyxMq4tfjMiUUOcjjtV0tJS
• TLSH: T1F432AEF36057DD4C3A87AB03ADEB10597145C2C96236A2A44899773CD5BC3FD2E20A74
• Submitted as: f80014_68b861bed6e64ed4a601ad515f87f712.pdf
• File type: pdf · Size: 44652 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=continuous+exponential+growth+worksheet, https://cdn.shopify.com/s/files/1/0434/0521/3854/files/sogajevosaverapefur.pdf, https://cdn.shopify.com/s/files/1/0438/9457/1163/files/tratamiento_de_apnea_del_sueo.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=continuous+exponential+growth+worksheet
• https://cdn.shopify.com/s/files/1/0434/0521/3854/files/sogajevosaverapefur.pdf
• https://cdn.shopify.com/s/files/1/0438/9457/1163/files/tratamiento_de_apnea_del_sueo.pdf
• https://cdn.shopify.com/s/files/1/0437/2620/9175/files/adobe_x_pro_convert_to_word.pdf
• https://cdn.shopify.com/s/files/1/0431/2019/7789/files/21919149123.pdf
• https://cdn.shopify.com/s/files/1/0434/8330/0005/files/adaptive_leadership.pdf
• https://217bbadf-1188-4004-887d-ab7a3a460b89.filesusr.com/ugd/26481d_87ff6b865411420d8838fd0405e56c91.pdf?index=true
• https://8f2a93a9-e5af-4862-9dbc-463086f3e67f.filesusr.com/ugd/6924eb_01605b890eb6498ebd1be03eca2e83fb.pdf?index=true
• https://662e8fe6-4064-48b5-8bb7-46b1054fd1c3.filesusr.com/ugd/60e703_fc8ccb1cc528460880396e6be203a3d8.pdf?index=true
• https://68db9b62-3cd1-4b2e-917b-5e5535b266c8.filesusr.com/ugd/bc0b97_f8605cd3cf8d49a292704d4b3a75a8bf.pdf?index=true
• https://4461b739-6b3d-437d-b859-48cab4fd3c8a.filesusr.com/ugd/3ddeef_fbc6e8241e1e463da6a206596f12f42d.pdf?index=true
• https://cdn.shopify.com/s/files/1/0431/9635/0626/files/escape_room_answer_level_88.pdf
• https://cdn.shopify.com/s/files/1/0436/1519/1202/files/debekuxamefarunarezisebut.pdf
• https://cdn.shopify.com/s/files/1/0481/4484/2903/files/25627169397.pdf
• https://cdn.shopify.com/s/files/1/0437/0428/7383/files/allu_arjun_movie_photos.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• cdn.shopify.com
• 217bbadf-1188-4004-887d-ab7a3a460b89.filesusr.com
• 8f2a93a9-e5af-4862-9dbc-463086f3e67f.filesusr.com
• 662e8fe6-4064-48b5-8bb7-46b1054fd1c3.filesusr.com
• 68db9b62-3cd1-4b2e-917b-5e5535b266c8.filesusr.com
• 4461b739-6b3d-437d-b859-48cab4fd3c8a.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report