MALICIOUS — a86d68_01c8ef7c2369496989d6abef11586380.pdf

MALICIOUS — a86d68_01c8ef7c2369496989d6abef11586380.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 862090c1b07faa9d42d9486b33cfa660cee72328e28f71d7338b14eef62e0308
• SHA-1: bb95ede42987c41feea07b09f19262464ad78d37
• MD5: e0df7f6fe500af6a5c692b891e6c8ba1
• ssdeep: 768:HgGzpDuMFU1ai4LjH23FTDD3MHNfYy5K8GocATMeXyZ7eiEuZf:AGFCJx7y5KzowgyNeiEof
• TLSH: T1A3319EF300A7FC4C368ADF036EFE2559A089D7896231A664599C762CD0BC6EDAF00561
• Submitted as: a86d68_01c8ef7c2369496989d6abef11586380.pdf
• File type: pdf · Size: 42124 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=rainbow+sphere+toy, https://cdn.shopify.com/s/files/1/0430/7818/9205/files/competency_matrix_excel_template.pdf, https://cdn.shopify.com/s/files/1/0435/9648/0671/files/annual_confidential_report_sample_remarks.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=rainbow+sphere+toy
• https://cdn.shopify.com/s/files/1/0430/7818/9205/files/competency_matrix_excel_template.pdf
• https://cdn.shopify.com/s/files/1/0435/9648/0671/files/annual_confidential_report_sample_remarks.pdf
• https://cdn.shopify.com/s/files/1/0439/1131/5611/files/free_business_promo_after_effects_templates.pdf
• https://cdn.shopify.com/s/files/1/0432/3121/5774/files/dfsr_migration_guide.pdf
• https://cdn.shopify.com/s/files/1/0484/0236/6632/files/west_iceland_travel_guide.pdf
• https://cdn.shopify.com/s/files/1/0433/0727/0312/files/bible_commentary_books.pdf
• https://cdn.shopify.com/s/files/1/0436/0873/5907/files/lol_legacy_client.pdf
• https://cdn.shopify.com/s/files/1/0433/4754/2175/files/tomex.pdf
• https://cdn.shopify.com/s/files/1/0431/5460/4198/files/26969053999.pdf
• https://cdn.shopify.com/s/files/1/0446/3860/1379/files/business_communication_essentials_fourth_canadian_edition.pdf
• https://cdn.shopify.com/s/files/1/0432/0765/5579/files/carol_s_dweck_mindset.pdf
• https://cdn.shopify.com/s/files/1/0429/5419/5097/files/65666369348.pdf
• https://efcc13d5-fa24-4ef5-87e6-8174401c9ec9.filesusr.com/ugd/b1b3ad_932c6200b7c242249136abb5a0685e9d.pdf?index=true
• https://1324c4bf-eba7-424b-bbde-ba2773d55def.filesusr.com/ugd/b463f2_f31964ab6fc140d2916543e3bbb6760c.pdf?index=true
• https://00af6d0a-f362-4767-bc4a-c74048b4a2a9.filesusr.com/ugd/e49726_91459c727e264e2983c1037614126cae.pdf?index=true
• https://db4f1502-d954-4eab-8713-4d8c592c5051.filesusr.com/ugd/8bf3fc_3fef140dfe884763a5ef207a2539174b.pdf?index=true
• https://30568a1b-ef88-4909-9e76-65d4565507b3.filesusr.com/ugd/bc4951_2798d97c1ab0428eb940c25e94e7c97c.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• cdn.shopify.com
• efcc13d5-fa24-4ef5-87e6-8174401c9ec9.filesusr.com
• 1324c4bf-eba7-424b-bbde-ba2773d55def.filesusr.com
• 00af6d0a-f362-4767-bc4a-c74048b4a2a9.filesusr.com
• db4f1502-d954-4eab-8713-4d8c592c5051.filesusr.com
• 30568a1b-ef88-4909-9e76-65d4565507b3.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report