MALICIOUS — 3f80ec_5acb196abeae46908c415c7938f2ecfc.pdf

MALICIOUS — 3f80ec_5acb196abeae46908c415c7938f2ecfc.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 8fb79c03329afe2ee48a7abe190137c6def60aaa9de2a661e62c96ea237a0fc9
• SHA-1: 4ee4a20ad9bb7ebc0a1212a1afbfc73c4c5bb860
• MD5: bf8db697e255c4a72cba3bd1e022d89e
• ssdeep: 768:5YgGzpDTVRDiwVyV5BT5pFyxKIQ2lsuRWf/hZjhndkfH30TwpKOS/pwdd5bUpBs:XGFfvMfB30xKc2923jpu05bwBs
• TLSH: T18B33AEF36193FC4D7B8AAB03AEE700499149C68D51329AB40988736CD97C6FC7E60961
• Submitted as: 3f80ec_5acb196abeae46908c415c7938f2ecfc.pdf
• File type: pdf · Size: 48553 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=waffle+house+nutrition+chart, https://cdn.shopify.com/s/files/1/0431/2793/1034/files/whatsapp_iphone_7_plus_apk.pdf, https://cdn.shopify.com/s/files/1/0432/6585/1560/files/lepadan.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=waffle+house+nutrition+chart
• https://cdn.shopify.com/s/files/1/0431/2793/1034/files/whatsapp_iphone_7_plus_apk.pdf
• https://cdn.shopify.com/s/files/1/0432/6585/1560/files/lepadan.pdf
• https://cdn.shopify.com/s/files/1/0432/8377/5643/files/chapter_20_environmental_science_concept_review_answers.pdf
• https://cdn.shopify.com/s/files/1/0428/9835/8432/files/bewewolifokolugetu.pdf
• https://cdn.shopify.com/s/files/1/0432/1384/8731/files/27841960107.pdf
• https://cdn.shopify.com/s/files/1/0482/4013/2248/files/88912219225.pdf
• https://cdn.shopify.com/s/files/1/0438/1271/6704/files/34515136738.pdf
• https://cdn.shopify.com/s/files/1/0428/6549/2127/files/didupejebevigupifem.pdf
• https://cfcac515-33d2-4fa0-a2c0-742fdc6646cd.filesusr.com/ugd/bba345_b78471969c2c47689c1667c391844277.pdf?index=true
• https://adaca82c-bcdf-4b7d-9ad3-1794181a402f.filesusr.com/ugd/3283b0_0efd3362cacf41e29aa01180b9fa26a5.pdf?index=true
• https://b15572dc-a693-48ae-92b7-4548dde14524.filesusr.com/ugd/29c71c_1375f0ec32e64e6c80f342a95abc25ea.pdf?index=true
• https://825a1024-bb7a-4adf-92c6-b914ac21ddab.filesusr.com/ugd/f1780b_6fdeed7b85a149749cb18f9e1e52f613.pdf?index=true
• https://1b6f36bd-2ece-493a-bda4-7da7d2cd8f06.filesusr.com/ugd/4b874d_29d41badef08491487940a43f68c358b.pdf?index=true
• https://cdn.shopify.com/s/files/1/0436/4949/9289/files/wekabovabumepemotodozas.pdf
• https://cdn.shopify.com/s/files/1/0434/6776/7972/files/belajar_membaca_tanpa_mengeja_buku_1.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• cdn.shopify.com
• cfcac515-33d2-4fa0-a2c0-742fdc6646cd.filesusr.com
• adaca82c-bcdf-4b7d-9ad3-1794181a402f.filesusr.com
• b15572dc-a693-48ae-92b7-4548dde14524.filesusr.com
• 825a1024-bb7a-4adf-92c6-b914ac21ddab.filesusr.com
• 1b6f36bd-2ece-493a-bda4-7da7d2cd8f06.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report