MALICIOUS — 4bdc6d_b6b314a3dad04c4b9e9d7e56680f637a.pdf

MALICIOUS — 4bdc6d_b6b314a3dad04c4b9e9d7e56680f637a.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: 80b00bb6bcbf732c921b726c9e84a09ef0c524e96623ac142bc71fd54d4ff78f
• SHA-1: 528c80b38a37debd4d36dff759c4463e5e7c12d2
• MD5: 10b58430d595073859778ceae7b77f92
• ssdeep: 768:WgGzpDD1RcLioNSwymWEzdUQuuJ0rm+03w4GCOFjJn2:DGF/QxWENJD+RQgJn2
• TLSH: T10131AEF75097EC4C3EC75B03ADAA1048A085C78D72379B7059C97BAD84BC2BDAE50921
• Submitted as: 4bdc6d_b6b314a3dad04c4b9e9d7e56680f637a.pdf
• File type: pdf · Size: 43245 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=toca+life+farm+full+apk, https://4bdeadfd-8588-41e7-b157-dbfbae86ff09.filesusr.com/ugd/48bf55_76a092e82d694663967bfbf61ddf2446.pdf?index=true, https://bc9fa632-8ea5-4c3f-b548-e27ee5a7d820.filesusr.com/ugd/0fdb6d_13af07f4714942adb47072a4880c5bde.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=toca+life+farm+full+apk
• https://4bdeadfd-8588-41e7-b157-dbfbae86ff09.filesusr.com/ugd/48bf55_76a092e82d694663967bfbf61ddf2446.pdf?index=true
• https://bc9fa632-8ea5-4c3f-b548-e27ee5a7d820.filesusr.com/ugd/0fdb6d_13af07f4714942adb47072a4880c5bde.pdf?index=true
• https://cea1a2b4-d6c6-4d08-b17a-26b46b6461b2.filesusr.com/ugd/735189_5ed0ad1c02f84817959d0be872bef527.pdf?index=true
• https://797c8325-bbec-4774-bc39-f431b669bc94.filesusr.com/ugd/e3ff21_2c4da5684b83460aaf472949107339de.pdf?index=true
• https://d49083c1-a543-481b-b38c-90ff94405696.filesusr.com/ugd/865d50_217de7213fce48e8b1db075a74afee6c.pdf?index=true
• https://8c1ce65d-fe86-444b-a45c-f87d5f27e746.filesusr.com/ugd/952c2e_cd081a3ee6094f09ae68b8fd41972008.pdf?index=true
• https://4b5da7d6-8a00-4e91-b816-ef37b8500ee1.filesusr.com/ugd/3225da_e964494e60f44f42b0f50eef48e2bcb6.pdf?index=true
• https://b513b5a0-02f9-466b-b0d7-dc9d84107f6a.filesusr.com/ugd/eaf48f_b56e78eab1824683b5a01bf331971282.pdf?index=true
• https://7c87b136-73b7-4421-bd9a-ac39ac2a33b5.filesusr.com/ugd/e3ff21_e2e7f4d67f2d426ca2c0e3c8710f2f56.pdf?index=true
• https://ae5f4f0c-dc59-4df0-ba50-facd1f4c339e.filesusr.com/ugd/3283b0_4991e5a4a6e946d19090865f83126c67.pdf?index=true
• https://c2f1c814-b4e1-4763-8f3e-7d9dd8a717ef.filesusr.com/ugd/bb05c1_dfb1a16a3a444747b2407d31184b74b3.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• 4bdeadfd-8588-41e7-b157-dbfbae86ff09.filesusr.com
• bc9fa632-8ea5-4c3f-b548-e27ee5a7d820.filesusr.com
• cea1a2b4-d6c6-4d08-b17a-26b46b6461b2.filesusr.com
• 797c8325-bbec-4774-bc39-f431b669bc94.filesusr.com
• d49083c1-a543-481b-b38c-90ff94405696.filesusr.com
• 8c1ce65d-fe86-444b-a45c-f87d5f27e746.filesusr.com
• 4b5da7d6-8a00-4e91-b816-ef37b8500ee1.filesusr.com
• b513b5a0-02f9-466b-b0d7-dc9d84107f6a.filesusr.com
• 7c87b136-73b7-4421-bd9a-ac39ac2a33b5.filesusr.com
• ae5f4f0c-dc59-4df0-ba50-facd1f4c339e.filesusr.com
• c2f1c814-b4e1-4763-8f3e-7d9dd8a717ef.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report