MALICIOUS — 69695d_4bca5a7f6cde4b37bfb855cddd9bce3e.pdf

MALICIOUS — 69695d_4bca5a7f6cde4b37bfb855cddd9bce3e.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: a01871a87d57238777785beac5a21e20877cb7e3295a956b3c514ba564ad8843
• SHA-1: 4c09f616c4b0989b4e5c086c8cc0b51ae561ee7d
• MD5: 58e1180f852cef7b7cf21f8ec69a044d
• ssdeep: 1536:FGFtQCS/ryOwISnFAvk8Y4jX9DMrsSbLFieeuLX17zGOOA:YFtQ72OpSnia4jXyASbLFNT17zGi
• TLSH: T1B537C0F315AADC843A965F036EB8209CA055CAC45072E76466ED7BACCC7C3FC9E81950
• Submitted as: 69695d_4bca5a7f6cde4b37bfb855cddd9bce3e.pdf
• File type: pdf · Size: 75340 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=kangertech+kbox+mini+c+manual, https://0d94bd61-9153-4e23-9846-a7f9d1ead548.filesusr.com/ugd/5a4c69_d61664a2fa144e09acd576660086b286.pdf?index=true, https://edaae36c-eb72-4151-ab60-ba4685fa8461.filesusr.com/ugd/4f270c_27f026af6dc04d91be26d0f83142c488.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=kangertech+kbox+mini+c+manual
• https://0d94bd61-9153-4e23-9846-a7f9d1ead548.filesusr.com/ugd/5a4c69_d61664a2fa144e09acd576660086b286.pdf?index=true
• https://edaae36c-eb72-4151-ab60-ba4685fa8461.filesusr.com/ugd/4f270c_27f026af6dc04d91be26d0f83142c488.pdf?index=true
• https://78b26516-0c1b-43e9-8f4d-b4ba5d094cc5.filesusr.com/ugd/c88839_ad2c94c636d94259bf32f83b1e1af1c0.pdf?index=true
• https://fa336faa-566f-48db-bbaa-738a8c9f5c61.filesusr.com/ugd/99b222_290e7d39aa2642a69c1fb36c29235447.pdf?index=true
• https://6cb89870-42fe-4e47-a074-32f9e2c6231f.filesusr.com/ugd/9ff9b8_d14ed49edee14fe695b20f3c3cb2543a.pdf?index=true
• https://247ebf1e-884b-4add-a9d9-8e8523b8324b.filesusr.com/ugd/0a84ca_a345572935aa48718e00ed47fe9fc0ad.pdf?index=true
• https://7a021712-8ca0-4611-b629-fb9a0eb5bbd3.filesusr.com/ugd/2486b5_f570ffeeffbe43d8b027a38870486f0e.pdf?index=true
• https://c53e47a9-e254-4cad-b889-493b7f17d275.filesusr.com/ugd/4733ca_5dbfea51131a4e2ea2caabc5c7fab10e.pdf?index=true
• https://f392e6ce-2412-40cd-809a-567f5b1fd438.filesusr.com/ugd/e2c223_4c9de472ed96477990b666bebb1fa8a5.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• 0d94bd61-9153-4e23-9846-a7f9d1ead548.filesusr.com
• edaae36c-eb72-4151-ab60-ba4685fa8461.filesusr.com
• 78b26516-0c1b-43e9-8f4d-b4ba5d094cc5.filesusr.com
• fa336faa-566f-48db-bbaa-738a8c9f5c61.filesusr.com
• 6cb89870-42fe-4e47-a074-32f9e2c6231f.filesusr.com
• 247ebf1e-884b-4add-a9d9-8e8523b8324b.filesusr.com
• 7a021712-8ca0-4611-b629-fb9a0eb5bbd3.filesusr.com
• c53e47a9-e254-4cad-b889-493b7f17d275.filesusr.com
• f392e6ce-2412-40cd-809a-567f5b1fd438.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report