MALICIOUS — 0b46e6_7f5ff97f3b6d42d1be819e861c95b613.pdf

MALICIOUS — 0b46e6_7f5ff97f3b6d42d1be819e861c95b613.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 8fd015962c6778040430b197e34f4f535d4e6175c9de495817038312b265569e
• SHA-1: fff85d093eabe120529bff38b5111084fad066d0
• MD5: 7196826debdd67306bd148caf7192085
• ssdeep: 768:aXgGzpD3NI7lwSLpAXvyIQs9ls2ErvVIkWrnFVXExMDxUiAEZ28Pjler3gNyaB2N:awGF7WBcawZmV6nLXExoUjs7lebgN5AN
• TLSH: T1F433CFF35097ED8D3A96AB536CEA1455214AD24D6233976009DC77BCC4BC37CEE10621
• Submitted as: 0b46e6_7f5ff97f3b6d42d1be819e861c95b613.pdf
• File type: pdf · Size: 49112 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=wentworth+season+7+episode+4+watch+online, https://3b0d5f92-d03b-476a-bc14-aad8e9f20e55.filesusr.com/ugd/8aba0c_2e93f9c2c54e4bf2bcd897b3f2e2d96a.pdf?index=true, https://a1e9d34c-91a0-48b7-86d2-fe8361486a30.filesusr.com/ugd/43d598_efbbf3244b5343a59829bbf28d8a49f8.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=wentworth+season+7+episode+4+watch+online
• https://3b0d5f92-d03b-476a-bc14-aad8e9f20e55.filesusr.com/ugd/8aba0c_2e93f9c2c54e4bf2bcd897b3f2e2d96a.pdf?index=true
• https://a1e9d34c-91a0-48b7-86d2-fe8361486a30.filesusr.com/ugd/43d598_efbbf3244b5343a59829bbf28d8a49f8.pdf?index=true
• https://2b02d3f5-f7fd-4b8a-80de-19b627be212e.filesusr.com/ugd/6a7407_81b13ea9aec140ad8686e8026613c738.pdf?index=true
• https://cdn.shopify.com/s/files/1/0430/2507/2282/files/calendario_rusia_2018_hora_colombia.pdf
• https://cdn.shopify.com/s/files/1/0448/2033/2705/files/irish_bouzouki_chords_gdad.pdf
• https://cdn.shopify.com/s/files/1/0429/4174/3263/files/3785863772.pdf
• https://a34c4e6f-ebbd-46ad-89b4-eea9a34d52da.filesusr.com/ugd/26481d_407564f9ffbb43d8ad9e3fe25ea6ae41.pdf?index=true
• https://c4eb01f7-5d26-4dec-b54c-a082e26ce542.filesusr.com/ugd/38062a_e3dd3bb13a354ec8bc23b80cabe990a2.pdf?index=true
• https://4ea909f9-f380-4201-bce4-9064e7b83d1c.filesusr.com/ugd/7f614e_ebb68322e7ed4be2a4a0bd76af69ca31.pdf?index=true
• https://f6c15a2d-8280-45be-8b0c-8ceb47434da2.filesusr.com/ugd/6924eb_8a383d7504bb47cdac22955aada03979.pdf?index=true
• https://7506d60d-6861-4a97-b74a-53df23f2bf42.filesusr.com/ugd/3eb4bd_e24969044667485ebbd26fa1139f025e.pdf?index=true
• https://cdn.shopify.com/s/files/1/0429/3279/7607/files/83985496855.pdf
• https://cdn.shopify.com/s/files/1/0431/6083/0111/files/kuvaxuzopaludimefodisebat.pdf
• https://cdn.shopify.com/s/files/1/0436/8406/9526/files/particle_swarm_optimization_algorithm_matlab_code.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• 3b0d5f92-d03b-476a-bc14-aad8e9f20e55.filesusr.com
• a1e9d34c-91a0-48b7-86d2-fe8361486a30.filesusr.com
• 2b02d3f5-f7fd-4b8a-80de-19b627be212e.filesusr.com
• cdn.shopify.com
• a34c4e6f-ebbd-46ad-89b4-eea9a34d52da.filesusr.com
• c4eb01f7-5d26-4dec-b54c-a082e26ce542.filesusr.com
• 4ea909f9-f380-4201-bce4-9064e7b83d1c.filesusr.com
• f6c15a2d-8280-45be-8b0c-8ceb47434da2.filesusr.com
• 7506d60d-6861-4a97-b74a-53df23f2bf42.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report