MALICIOUS — 9e14ca_63aacafcaf8e4119b82929eb5251c697.pdf

MALICIOUS — 9e14ca_63aacafcaf8e4119b82929eb5251c697.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 8522934e0e818a834bf3772a7c4b052f32a4e8e1aca1cbc274cc2706204abdc5
• SHA-1: 98816660c321bcdd980a3048e34aad47ae72ead1
• MD5: c97297281effcf10cd21e184d8034abe
• ssdeep: 768:XgGzpDA/JjkU847J6eGEmQHtTnodQdFQ3iIudscSdxq/KNliKrp6n9z8q1:wGFsbGEmmnodQIruds1q/krAn9z8q1
• TLSH: T1C6319FF300A7ED8C6A87AB13AEEA04565186D2CC6133976069D97B6CD4BC2BD7F40530
• Submitted as: 9e14ca_63aacafcaf8e4119b82929eb5251c697.pdf
• File type: pdf · Size: 41682 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=mini+cooper+vin+decoder+options, https://a813a4ad-d838-43a9-95c5-7a4e9135dd59.filesusr.com/ugd/4d548e_4adc546d86484e2587feeb206c865b7f.pdf?index=true, https://6f5d7eee-6bd4-4792-a61f-e483692e84e8.filesusr.com/ugd/bdc04d_638491b1fa464de5b8fca9f3d037ea18.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=mini+cooper+vin+decoder+options
• https://a813a4ad-d838-43a9-95c5-7a4e9135dd59.filesusr.com/ugd/4d548e_4adc546d86484e2587feeb206c865b7f.pdf?index=true
• https://6f5d7eee-6bd4-4792-a61f-e483692e84e8.filesusr.com/ugd/bdc04d_638491b1fa464de5b8fca9f3d037ea18.pdf?index=true
• https://eea8265a-0adc-4cb8-b384-21a265a3eed2.filesusr.com/ugd/668a47_471659e0d90e4478969d4e3a4b62020a.pdf?index=true
• https://cdn.shopify.com/s/files/1/0431/1567/5809/files/38273767109.pdf
• https://cdn.shopify.com/s/files/1/0436/9353/9482/files/important_days_and_dates_for_bank_exams.pdf
• https://cdn.shopify.com/s/files/1/0433/7106/9594/files/eclipse_auto_format_on_save.pdf
• https://cdn.shopify.com/s/files/1/0465/1519/1966/files/83559232486.pdf
• https://cdn.shopify.com/s/files/1/0433/7677/1224/files/japan_rail_pass_guide_book.pdf
• https://cdn.shopify.com/s/files/1/0430/7527/2855/files/steam_speed_inconsistent.pdf
• https://cdn.shopify.com/s/files/1/0461/9904/6297/files/8513493915.pdf
• https://8a0c4a90-8751-45fe-8d9a-c8dcd25d1485.filesusr.com/ugd/067ecb_ae6b8142f7d641b882d298f38ccb8ab6.pdf?index=true
• https://1dea48a8-ace8-4c28-b897-8eb2d0688725.filesusr.com/ugd/668a47_60331b61223f461f976d27fd81b37f71.pdf?index=true
• https://7608fbf3-0031-4c19-8f76-94419b294b6b.filesusr.com/ugd/8e6e76_87457d9a5c514557a79f97c8902e1a20.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• a813a4ad-d838-43a9-95c5-7a4e9135dd59.filesusr.com
• 6f5d7eee-6bd4-4792-a61f-e483692e84e8.filesusr.com
• eea8265a-0adc-4cb8-b384-21a265a3eed2.filesusr.com
• cdn.shopify.com
• 8a0c4a90-8751-45fe-8d9a-c8dcd25d1485.filesusr.com
• 1dea48a8-ace8-4c28-b897-8eb2d0688725.filesusr.com
• 7608fbf3-0031-4c19-8f76-94419b294b6b.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report