MALICIOUS — a37a2e_9cd92106eff142ff95f38a99b1b7d1f2.pdf

MALICIOUS — a37a2e_9cd92106eff142ff95f38a99b1b7d1f2.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 54 detection engines flagged it.

Identification

• SHA-256: 8ab34dc0e8128fc95b2dd9f896afd0614df56302ae4e8faefce314da86880854
• SHA-1: 282db633bc5b2a20c3245af8ef6b7abac5209044
• MD5: afb951336427a8277ff9b5c32d1289d6
• ssdeep: 768:1gGzpD8hs9WzMWpp7H9gUnSLHj/l1fRS5WEh4Ds1OnOzy2:mGFwfIWHHFnSHA57is1uAy2
• TLSH: T108319DF3549BDC4C3A8B6B036DD611096086DA8D7126E7B494E86B6CC9BC6FD5F20830
• Submitted as: a37a2e_9cd92106eff142ff95f38a99b1b7d1f2.pdf
• File type: pdf · Size: 41823 bytes
• Verdict: malicious (78/100)

Detections (2 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=poem+to+analyze+6th+grade, https://54b81999-bfa5-4cef-a4bd-ff0af1ccccc2.filesusr.com/ugd/067ecb_65a0c428cebc450f9f690b3f7a58e546.pdf?index=true, https://9f38e598-0eb6-4ab4-b425-6297cbffd2b3.filesusr.com/ugd/33ab24_acceefce51404c91b79c8c3a8bb9fb81.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=poem+to+analyze+6th+grade
• https://54b81999-bfa5-4cef-a4bd-ff0af1ccccc2.filesusr.com/ugd/067ecb_65a0c428cebc450f9f690b3f7a58e546.pdf?index=true
• https://9f38e598-0eb6-4ab4-b425-6297cbffd2b3.filesusr.com/ugd/33ab24_acceefce51404c91b79c8c3a8bb9fb81.pdf?index=true
• https://36673e42-9503-4994-8775-8a73962bf7a2.filesusr.com/ugd/38062a_03a7dfecb6aa4b48a262f9b0378a1198.pdf?index=true
• https://020d39f1-ded3-46f7-bce4-7b271855f8dc.filesusr.com/ugd/a31856_7b50b018a35746808c12028d5447405d.pdf?index=true
• https://a67fbd7e-3009-47cf-9435-b51e3c573750.filesusr.com/ugd/4cf28d_8e1b7c6b63cb4c22adc307ae1ea82492.pdf?index=true
• https://5690000a-664f-41d1-a226-23cfee3c2662.filesusr.com/ugd/39a0fd_f39ffbb9d1cc491181387be051002008.pdf?index=true
• https://477ff52b-01d0-48d7-bb60-9fd520e2fdf3.filesusr.com/ugd/7a359d_2a954b7cf3974cc69b6d592efb76d9f9.pdf?index=true
• https://ca102416-e4b1-40e7-a797-b43af89b2241.filesusr.com/ugd/aec2ea_6589bd2bbfdf41c59a6c4f13cafa1722.pdf?index=true
• https://b5692261-78f2-4434-8a89-3f5ecb5531d3.filesusr.com/ugd/9c66ff_b090303375e548c68de537dd4b396d0f.pdf?index=true
• https://af31931c-7e09-4703-a4c0-7c6059be5d85.filesusr.com/ugd/2b25b5_44bfb324cccb4c9a9c3edc071d442079.pdf?index=true
• https://cd5992fc-85c2-4109-9e57-7b4c6076e582.filesusr.com/ugd/18122d_d3133ac7a4a845939292a1396218063f.pdf?index=true
• https://ec06fc4a-cf92-47bc-94ad-4907fb07a79a.filesusr.com/ugd/592671_41b1995316a74fce8ac94b8a64f9bd32.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• 54b81999-bfa5-4cef-a4bd-ff0af1ccccc2.filesusr.com
• 9f38e598-0eb6-4ab4-b425-6297cbffd2b3.filesusr.com
• 36673e42-9503-4994-8775-8a73962bf7a2.filesusr.com
• 020d39f1-ded3-46f7-bce4-7b271855f8dc.filesusr.com
• a67fbd7e-3009-47cf-9435-b51e3c573750.filesusr.com
• 5690000a-664f-41d1-a226-23cfee3c2662.filesusr.com
• 477ff52b-01d0-48d7-bb60-9fd520e2fdf3.filesusr.com
• ca102416-e4b1-40e7-a797-b43af89b2241.filesusr.com
• b5692261-78f2-4434-8a89-3f5ecb5531d3.filesusr.com
• af31931c-7e09-4703-a4c0-7c6059be5d85.filesusr.com
• cd5992fc-85c2-4109-9e57-7b4c6076e582.filesusr.com
• ec06fc4a-cf92-47bc-94ad-4907fb07a79a.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report