MALICIOUS — 405339_15916d5cd0704dd294f5b295c4f8b5ed.pdf
MALICIOUS — 405339_15916d5cd0704dd294f5b295c4f8b5ed.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
907925c4fee51399df2546082b464e9be27579f63a24257203de0a791994d9ba - SHA-1:
695f9622d66813feebe1dd5287a772581e599bef - MD5:
286eb7ac61da957afd13ad46a2a96cdf - ssdeep:
768:PgGzpDPa4fdNDVw5doQVd0x1SeXGen75Chvk/GVgO9TyOjBTTrR4bEWyK+KAp:4GFrP3XPdG+O5yONTTrw0KAp - TLSH:
T15A33BFF3549BEC4C7ACA8B536DEA2169504AC34D6132A75018ED3B2CD5BC6BCBF10960 - Submitted as: 405339_15916d5cd0704dd294f5b295c4f8b5ed.pdf
- File type: pdf · Size: 48528 bytes
- Verdict: malicious (78/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The malicious score of 78/100 is the fusion of 5 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ttraff.me/wix?keyword=andy+carpenter+series+in+order, https://cdn.shopify.com/s/files/1/0439/8009/5646/files/56125665568.pdf, https://cdn.shopify.com/s/files/1/0435/6915/2163/files/fibewakiwudovugak.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.me/wix?keyword=andy+carpenter+series+in+order
- https://cdn.shopify.com/s/files/1/0439/8009/5646/files/56125665568.pdf
- https://cdn.shopify.com/s/files/1/0435/6915/2163/files/fibewakiwudovugak.pdf
- https://cdn.shopify.com/s/files/1/0462/8289/9616/files/genuv.pdf
- https://cdn.shopify.com/s/files/1/0428/8924/8927/files/robez.pdf
- https://cdn.shopify.com/s/files/1/0431/0774/5958/files/89320147121.pdf
- https://fc3a590f-a8df-4e47-a491-da4d48264b36.filesusr.com/ugd/fedf23_ffb58d187dfc4756ab89be5dfee7c68d.pdf?index=true
- https://4bb03bf3-83dd-4ca2-8ffd-72fe058a8b61.filesusr.com/ugd/3ed902_7a57b8c9488b40cb869d4cd3a51d87b3.pdf?index=true
- https://b93480bb-2fce-4350-913f-ea641cefad62.filesusr.com/ugd/a98ecc_b06851e3c2d846528f057e51108791a5.pdf?index=true
- https://2e665acb-392f-4417-8346-21707f3e9e5f.filesusr.com/ugd/d2cc1f_ebada1a1ad74432db75d3d7111e36302.pdf?index=true
- https://7857122f-9bbd-4fb9-91ea-c3f489fd7a0b.filesusr.com/ugd/d8966e_15338ccf19b9430187128a52a7db3795.pdf?index=true
- https://26fdc8cc-094c-436f-930f-211c93324804.filesusr.com/ugd/938c70_a09db7811fc54066b4e4a1cc73cbb139.pdf?index=true
- https://43fc62cf-ff9d-4f95-9302-50eb9edf88dc.filesusr.com/ugd/d2cc1f_da5074b57bb6443dbc595c59dea54f7f.pdf?index=true
- https://0bc9768f-85c2-4c70-87f7-155b099d7516.filesusr.com/ugd/e2c6c1_0fff557e395b488d8c13901b3a4ef807.pdf?index=true
- https://cdn.shopify.com/s/files/1/0429/4203/8182/files/dowinol.pdf
- https://cdn.shopify.com/s/files/1/0428/2250/0518/files/bibikelufuzukowupofu.pdf
- https://cdn.shopify.com/s/files/1/0431/5450/5882/files/48939454446.pdf
- https://cdn.shopify.com/s/files/1/0435/9372/8158/files/if_else_statement_in_r.pdf
- https://cdn.shopify.com/s/files/1/0434/4211/0631/files/18311952879.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ttraff.me
- cdn.shopify.com
- fc3a590f-a8df-4e47-a491-da4d48264b36.filesusr.com
- 4bb03bf3-83dd-4ca2-8ffd-72fe058a8b61.filesusr.com
- b93480bb-2fce-4350-913f-ea641cefad62.filesusr.com
- 2e665acb-392f-4417-8346-21707f3e9e5f.filesusr.com
- 7857122f-9bbd-4fb9-91ea-c3f489fd7a0b.filesusr.com
- 26fdc8cc-094c-436f-930f-211c93324804.filesusr.com
- 43fc62cf-ff9d-4f95-9302-50eb9edf88dc.filesusr.com
- 0bc9768f-85c2-4c70-87f7-155b099d7516.filesusr.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report