MALICIOUS — c638b7_cd6396024a184043aed9f159ba961087.pdf

MALICIOUS — c638b7_cd6396024a184043aed9f159ba961087.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: 91445f311a950ca70d68e11316194a2cdf37149c25ca3797c9c566d637cc477c
• SHA-1: 575ad3ff22ebc71d0c0d1488b095764a4fb8f0af
• MD5: b52397930a54806450ec840c6d13c994
• ssdeep: 768:OgGzpDDfrAzDm5eZf0+NKD9aD2iyTg3lYlERfvf01GAbNP6X7oyvaz:rGF/8C9aDXyUVEERfn0Ls7oyvaz
• TLSH: T19F308DF70487ED4D6A87AB436EEB14556089CA8C2123E770499C772CE4BC6BC7E20E51
• Submitted as: c638b7_cd6396024a184043aed9f159ba961087.pdf
• File type: pdf · Size: 37192 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=exam+955+study+guide, https://cdn.shopify.com/s/files/1/0434/5312/0664/files/tubim.pdf, https://cdn.shopify.com/s/files/1/0437/4547/6757/files/algebraic_expressions_worksheet_with_answers.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=exam+955+study+guide
• https://cdn.shopify.com/s/files/1/0434/5312/0664/files/tubim.pdf
• https://cdn.shopify.com/s/files/1/0437/4547/6757/files/algebraic_expressions_worksheet_with_answers.pdf
• https://cdn.shopify.com/s/files/1/0432/1751/8751/files/canon_imageclass_mf3010_software_free.pdf
• https://cdn.shopify.com/s/files/1/0430/4994/3202/files/83926361808.pdf
• https://cdn.shopify.com/s/files/1/0435/5656/9249/files/zejolozadosukofuleje.pdf
• https://cdn.shopify.com/s/files/1/0429/7093/9541/files/13640899154.pdf
• https://cdn.shopify.com/s/files/1/0431/7341/3028/files/gofemabegogavepe.pdf
• https://cdn.shopify.com/s/files/1/0434/0806/4677/files/sap_fiori_for_sap_s_4hana_1809_installation_guide.pdf
• https://cdn.shopify.com/s/files/1/0463/5761/0662/files/android_carplay_mercedes_a_class.pdf
• https://cdn.shopify.com/s/files/1/0431/1010/5255/files/jirojuzipozuviwekuwibow.pdf
• https://cdn.shopify.com/s/files/1/0428/5284/3676/files/unicorn_invitation_template_free.pdf
• https://29c93198-f742-4700-bd49-fe833de9997a.filesusr.com/ugd/7cefa9_b4faf4a4986c45128480257de5c9cf09.pdf?index=true
• https://ecaa4efb-93b1-44b2-9fa2-5ff0c11f3bc4.filesusr.com/ugd/451a43_ddb3b32531f94a6994f73f725c42f951.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• cdn.shopify.com
• 29c93198-f742-4700-bd49-fe833de9997a.filesusr.com
• ecaa4efb-93b1-44b2-9fa2-5ff0c11f3bc4.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report