MALICIOUS — cbe7f7_1fbe41fb54ae4dcca7679156e5b98410.pdf

MALICIOUS — cbe7f7_1fbe41fb54ae4dcca7679156e5b98410.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 9756bafcee327478a89afa38c320ca469f9e85f3f49d395e5696e7396fe672fa
• SHA-1: 13cad28cd83cf067a1c566c98f4b075f0ec93e8a
• MD5: 683d453597da47d1ccf4e6e4f4723f61
• ssdeep: 3072:KFelK8Eio+DTHCzp2TDO6jRlz52OsT0n8KwjiAzl+5Aj8Bz:a2ez0a69wnT/jVxj8Bz
• TLSH: T1583DF1F31087EDCC32CAAB03BBE21055544AD6847173A9E558E97A3DC83867E9F11A21
• Submitted as: cbe7f7_1fbe41fb54ae4dcca7679156e5b98410.pdf
• File type: pdf · Size: 131272 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=gucci+mane+autobiography+pdf, https://d8c6ff99-b511-4aec-8894-c9b3081001d8.filesusr.com/ugd/d2751c_788f09e6b78c4899b493f34551a152b8.pdf?index=true, https://b7cb60b2-bae1-4fc9-9c4a-039801ea18f9.filesusr.com/ugd/078c79_eefda89a11c8465299569aa9f9bb3b25.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=gucci+mane+autobiography+pdf
• https://d8c6ff99-b511-4aec-8894-c9b3081001d8.filesusr.com/ugd/d2751c_788f09e6b78c4899b493f34551a152b8.pdf?index=true
• https://b7cb60b2-bae1-4fc9-9c4a-039801ea18f9.filesusr.com/ugd/078c79_eefda89a11c8465299569aa9f9bb3b25.pdf?index=true
• https://98024094-01ac-46cd-afeb-c9fe479f20ee.filesusr.com/ugd/e2f7e1_69794879b150466ba2c30e2764e081ef.pdf?index=true
• https://cf5e1cb3-eb9c-4654-ab14-786af26157a7.filesusr.com/ugd/0fdb6d_874bf76ccfd74e8c9f55f20452fcc2dd.pdf?index=true
• https://3674d5b7-eb79-4515-a4a3-468367c6ce04.filesusr.com/ugd/3eed2b_6829184f58a44fedba0c59bf92df8e64.pdf?index=true
• https://83a72512-03ed-4a70-bceb-d60bd97169f3.filesusr.com/ugd/4bb894_a371fb5cc20e4104831fdc9e11cbeeb2.pdf?index=true
• https://75e16139-9432-4512-a2a2-e0429fe80c2b.filesusr.com/ugd/b0c717_77eb17de97c44145886466718c95aac5.pdf?index=true
• https://5ddfd583-9384-4477-8702-e738ba7a45e6.filesusr.com/ugd/7dfe85_68057b28695b48c0832725047d85c97d.pdf?index=true
• https://616c1b2a-4b05-4aa5-972b-46c149d52b7c.filesusr.com/ugd/28146e_14826a9e560c4701ac8f7db2f20c3a1e.pdf?index=true
• https://c1fd0f81-9630-4b5f-8cf8-fa5e9495c9c1.filesusr.com/ugd/b1b3ad_6c1e55b9e45841fd884ff587d09e3434.pdf?index=true
• https://056b3be7-3083-44fa-a3f6-b5ccb451a3a1.filesusr.com/ugd/003b86_e0236412a3e94a57ba5f6349ffa55284.pdf?index=true
• https://680a703f-381a-4d39-adc7-0a20be1ceb1e.filesusr.com/ugd/0b46e6_17a610c25de24d15ae8adc171af2b4c9.pdf?index=true
• https://494aa5cf-9174-411a-9aaf-46e29da4551c.filesusr.com/ugd/9df9d6_9a0596a6ff184fefa6b5ad61fa8aafa5.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• d8c6ff99-b511-4aec-8894-c9b3081001d8.filesusr.com
• b7cb60b2-bae1-4fc9-9c4a-039801ea18f9.filesusr.com
• 98024094-01ac-46cd-afeb-c9fe479f20ee.filesusr.com
• cf5e1cb3-eb9c-4654-ab14-786af26157a7.filesusr.com
• 3674d5b7-eb79-4515-a4a3-468367c6ce04.filesusr.com
• 83a72512-03ed-4a70-bceb-d60bd97169f3.filesusr.com
• 75e16139-9432-4512-a2a2-e0429fe80c2b.filesusr.com
• 5ddfd583-9384-4477-8702-e738ba7a45e6.filesusr.com
• 616c1b2a-4b05-4aa5-972b-46c149d52b7c.filesusr.com
• c1fd0f81-9630-4b5f-8cf8-fa5e9495c9c1.filesusr.com
• 056b3be7-3083-44fa-a3f6-b5ccb451a3a1.filesusr.com
• 680a703f-381a-4d39-adc7-0a20be1ceb1e.filesusr.com
• 494aa5cf-9174-411a-9aaf-46e29da4551c.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report