MALICIOUS — c5d40f_09c9ad4dd0684dcbb0af008a3358b633.pdf

MALICIOUS — c5d40f_09c9ad4dd0684dcbb0af008a3358b633.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 989235fa44200de3e4690ec2511e3f30bc79ef04c81f06cc4274c2bb0cb8f485
• SHA-1: a50fba6a0ad84bc563abb61e76d023fc7ac77bac
• MD5: 605bdefeab5d0b9815c5037f32167568
• ssdeep: 1536:dGFvHjy65Dkde/JpO1I0C1eSyXNbb4iuuGlCqtY:gFvOuodGJl1eSEbduuGle
• TLSH: T16933AEF3516BDC8C76CBAB0759FA10197106D7897132AAA055887F6CC4BC2FC6F11AA0
• Submitted as: c5d40f_09c9ad4dd0684dcbb0af008a3358b633.pdf
• File type: pdf · Size: 51274 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=guide+unlimited+clash+of+clans+hack, https://cdn.shopify.com/s/files/1/0427/6345/2583/files/obusforme_office_chair_staples.pdf, https://cdn.shopify.com/s/files/1/0428/9118/2243/files/digelijewutakewipatawowa.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=guide+unlimited+clash+of+clans+hack
• https://cdn.shopify.com/s/files/1/0433/2398/1979/files/nozox.pdf
• https://cdn.shopify.com/s/files/1/0427/6345/2583/files/obusforme_office_chair_staples.pdf
• https://cdn.shopify.com/s/files/1/0428/9118/2243/files/digelijewutakewipatawowa.pdf
• https://773ef88d-1138-4a1e-b619-871d5fb61b3b.filesusr.com/ugd/8a9bcc_e13c2caf5fe5457c93b5975c61aeae03.pdf?index=true
• https://55b0b90c-1f2f-4be5-86e6-8cc65db0c3d2.filesusr.com/ugd/dcf311_456f3a37c7fc454f81d2b566fdfaddc3.pdf?index=true
• https://3269139c-75f9-4785-96c6-75e9e9564169.filesusr.com/ugd/d4a9d6_2dce65f5eb194683bc3eb4f15ce33864.pdf?index=true
• https://3b23a6fd-56b2-485b-9941-cec6d5bc5928.filesusr.com/ugd/370021_b47812204a1e47a2afea2a0b335cf012.pdf?index=true
• https://c9d1dfd0-6e83-4399-ac58-51336cde029f.filesusr.com/ugd/8c5bc8_9fc5058d444d4e6889cc59c974af0178.pdf?index=true
• https://6f5d7eee-6bd4-4792-a61f-e483692e84e8.filesusr.com/ugd/bdc04d_638491b1fa464de5b8fca9f3d037ea18.pdf?index=true
• https://415bb92d-1f34-4624-93ed-ce0a68166b35.filesusr.com/ugd/269bb8_498b5cc3268345b086e5ce1498dc1436.pdf?index=true
• https://b513b5a0-02f9-466b-b0d7-dc9d84107f6a.filesusr.com/ugd/eaf48f_b56e78eab1824683b5a01bf331971282.pdf?index=true
• https://8306d17a-c09f-4fb4-92b7-87ac5a63a779.filesusr.com/ugd/f68081_3714d55dd140447fa5623cab056d0fc6.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• cdn.shopify.com
• 773ef88d-1138-4a1e-b619-871d5fb61b3b.filesusr.com
• 55b0b90c-1f2f-4be5-86e6-8cc65db0c3d2.filesusr.com
• 3269139c-75f9-4785-96c6-75e9e9564169.filesusr.com
• 3b23a6fd-56b2-485b-9941-cec6d5bc5928.filesusr.com
• c9d1dfd0-6e83-4399-ac58-51336cde029f.filesusr.com
• 6f5d7eee-6bd4-4792-a61f-e483692e84e8.filesusr.com
• 415bb92d-1f34-4624-93ed-ce0a68166b35.filesusr.com
• b513b5a0-02f9-466b-b0d7-dc9d84107f6a.filesusr.com
• 8306d17a-c09f-4fb4-92b7-87ac5a63a779.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report