MALICIOUS — 314c35_89cdd9025f2c463e8fc8b0b666881177.pdf

MALICIOUS — 314c35_89cdd9025f2c463e8fc8b0b666881177.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 9c71d64a444628f9830409d1a7b1e535af349fb4db1a8891a609407e1f559716
• SHA-1: 964674ffa7d1a223124ce893b983e12c98ffd90f
• MD5: b6d3dae9aad51f8dc8135bf3108b04ec
• ssdeep: 768:8WgGzpDwkNTNAlLeNm9+xr64jlxWM85ZdVD/BxqQU:SGF0kNZAlsr64jB85XNJxqQU
• TLSH: T19F308DF75497ED8C7A8BAF03A9AA11946405C38C2133A7B054CC7BACD57C6BDBE10920
• Submitted as: 314c35_89cdd9025f2c463e8fc8b0b666881177.pdf
• File type: pdf · Size: 36872 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=daewoo+air+conditioner+dwc-f0567fcl+manual, https://c47a3bde-6c14-4fd0-a7b5-8612e93f81ed.filesusr.com/ugd/5ea691_119c6d3ec22f41408b652ec57b8d62ac.pdf?index=true, https://f456afb6-84ea-44d9-9259-def42631c0c7.filesusr.com/ugd/370021_a234f8a3ba9f4d938a2c2d08ceb2239c.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=daewoo+air+conditioner+dwc-f0567fcl+manual
• https://c47a3bde-6c14-4fd0-a7b5-8612e93f81ed.filesusr.com/ugd/5ea691_119c6d3ec22f41408b652ec57b8d62ac.pdf?index=true
• https://f456afb6-84ea-44d9-9259-def42631c0c7.filesusr.com/ugd/370021_a234f8a3ba9f4d938a2c2d08ceb2239c.pdf?index=true
• https://94d1e7dc-429b-4480-99de-4e9014711929.filesusr.com/ugd/ac8c68_2fa93b2dceba441e85fe891cac7370cd.pdf?index=true
• https://c9ad4e29-fe0b-473d-9ff1-72d1b9562e12.filesusr.com/ugd/b56239_6b31dbc84e2d4835a2452c9a6688a71c.pdf?index=true
• https://b15572dc-a693-48ae-92b7-4548dde14524.filesusr.com/ugd/29c71c_1375f0ec32e64e6c80f342a95abc25ea.pdf?index=true
• https://0f5995ec-7d30-4793-8091-461e1e387be9.filesusr.com/ugd/c268f7_6483e94b02854440abe446731a3d83df.pdf?index=true
• https://e9c64cba-dd64-4c9f-a3fc-3e4cb357dd46.filesusr.com/ugd/b56239_58f6e0c562324ab18a06cdb4b9697a2f.pdf?index=true
• https://94db83d0-3165-45ec-871f-de637b1d37ec.filesusr.com/ugd/b148e5_6356c5192af5460dac7ddce490b49cd1.pdf?index=true
• https://64acbe55-006b-4f3b-abbc-ff5fbad85012.filesusr.com/ugd/48bf55_fb24482b5aa54fe2b8c87a20215f7091.pdf?index=true
• https://445dcb2e-18b1-4806-9cc3-56a473b492a2.filesusr.com/ugd/8da65f_236f9fb505cd45bea573b9d4a3133e30.pdf?index=true
• https://26029428-028f-496b-9036-92eacd7e9088.filesusr.com/ugd/ac8c68_47179dae32ce44619dac885bc6b4468a.pdf?index=true
• https://14379d81-c371-4c17-96d3-8c379952b0d3.filesusr.com/ugd/b56239_e3036553c238487b8343e9da5bd7bcd6.pdf?index=true
• https://2867e3a4-5af3-407e-8051-bcab6f7dffbd.filesusr.com/ugd/76aeb6_851b968a86fd4309b7537896c09802f6.pdf?index=true
• https://97745486-b142-4b7b-a773-50eba0c11020.filesusr.com/ugd/cc3ca9_d9cfc3807d9e4ca18d48ee6b3d130fc0.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• c47a3bde-6c14-4fd0-a7b5-8612e93f81ed.filesusr.com
• f456afb6-84ea-44d9-9259-def42631c0c7.filesusr.com
• 94d1e7dc-429b-4480-99de-4e9014711929.filesusr.com
• c9ad4e29-fe0b-473d-9ff1-72d1b9562e12.filesusr.com
• b15572dc-a693-48ae-92b7-4548dde14524.filesusr.com
• 0f5995ec-7d30-4793-8091-461e1e387be9.filesusr.com
• e9c64cba-dd64-4c9f-a3fc-3e4cb357dd46.filesusr.com
• 94db83d0-3165-45ec-871f-de637b1d37ec.filesusr.com
• 64acbe55-006b-4f3b-abbc-ff5fbad85012.filesusr.com
• 445dcb2e-18b1-4806-9cc3-56a473b492a2.filesusr.com
• 26029428-028f-496b-9036-92eacd7e9088.filesusr.com
• 14379d81-c371-4c17-96d3-8c379952b0d3.filesusr.com
• 2867e3a4-5af3-407e-8051-bcab6f7dffbd.filesusr.com
• 97745486-b142-4b7b-a773-50eba0c11020.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report