MALICIOUS — 5f226b_76f7657d87874037a4060fba617bf060.pdf

MALICIOUS — 5f226b_76f7657d87874037a4060fba617bf060.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 9aac6f1c8497e89cf3171ffe5ae22fb5bef28eb8a0f4f932065cbcbb37a5d388
• SHA-1: 519b741f0dc714ad7a80baecc441d5500b2dbd8f
• MD5: d3dfaa6d08c6359e8272917e315a6015
• ssdeep: 768:jgGzpDGsEZ2aJO2vNfWHAu5bqJkIxTM31ph1BUmf3XX:cGFisEvJcAu5bsFTM3P/f3XX
• TLSH: T19931AEF3414BED4C7B839F13A9EA001161469789B12296B049D93B6DD57C2FCAF608B1
• Submitted as: 5f226b_76f7657d87874037a4060fba617bf060.pdf
• File type: pdf · Size: 41495 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=we+wear+the+mask+poem+literary+devices, https://e3ee72df-1642-466f-84a7-60fdaf2d1d7e.filesusr.com/ugd/49f5ef_cc6a32eee75145e193c31ccea257b4b2.pdf?index=true, https://24973061-5e16-4ed9-894b-5a904fff3724.filesusr.com/ugd/70e7d4_70e8034385de4df7b509766cb08d17d3.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=we+wear+the+mask+poem+literary+devices
• https://e3ee72df-1642-466f-84a7-60fdaf2d1d7e.filesusr.com/ugd/49f5ef_cc6a32eee75145e193c31ccea257b4b2.pdf?index=true
• https://24973061-5e16-4ed9-894b-5a904fff3724.filesusr.com/ugd/70e7d4_70e8034385de4df7b509766cb08d17d3.pdf?index=true
• https://f7929993-41b0-42b0-8815-d173f37be073.filesusr.com/ugd/5bb01c_1be27fe50d6b4c11be90583d6c27061b.pdf?index=true
• https://5f475c2c-92ad-4e99-8246-6741821c5aeb.filesusr.com/ugd/5bb01c_e34f2da5f8164d61998e9f1da01c004b.pdf?index=true
• https://089ad1e0-b9ad-4d5d-8d98-a3eda7ed253e.filesusr.com/ugd/a2de88_aafc468ec3f54cd684be181ce2d0f3b3.pdf?index=true
• https://ad4625e8-6434-4738-bef9-95675f885def.filesusr.com/ugd/35c6e2_0c087df9fba842c0b6fcb2bac0cd73e1.pdf?index=true
• https://4d87a06e-aa10-46c6-be33-8766c83e166c.filesusr.com/ugd/e948c1_4da14832bf214f59a4ae0676f17bd173.pdf?index=true
• https://cdn.shopify.com/s/files/1/0438/4574/6838/files/35151229819.pdf
• https://cdn.shopify.com/s/files/1/0438/0160/8353/files/bahubali_2_malayalam_video_song.pdf
• https://d522f603-8341-4957-8ca8-22daf348534a.filesusr.com/ugd/eb6612_861f506771ef46f383022850a081eeb6.pdf?index=true
• https://5bd08710-670f-40e0-904a-18929f37303d.filesusr.com/ugd/b90ba1_9329497b1f2b41f8902c4d90e5759253.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• e3ee72df-1642-466f-84a7-60fdaf2d1d7e.filesusr.com
• 24973061-5e16-4ed9-894b-5a904fff3724.filesusr.com
• f7929993-41b0-42b0-8815-d173f37be073.filesusr.com
• 5f475c2c-92ad-4e99-8246-6741821c5aeb.filesusr.com
• 089ad1e0-b9ad-4d5d-8d98-a3eda7ed253e.filesusr.com
• ad4625e8-6434-4738-bef9-95675f885def.filesusr.com
• 4d87a06e-aa10-46c6-be33-8766c83e166c.filesusr.com
• cdn.shopify.com
• d522f603-8341-4957-8ca8-22daf348534a.filesusr.com
• 5bd08710-670f-40e0-904a-18929f37303d.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report