MALICIOUS — ce14f3_5783a12c17b64f46ad61c82076bb3591.pdf

MALICIOUS — ce14f3_5783a12c17b64f46ad61c82076bb3591.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

SHA-256: a05482561c1847bc9e90144d896e606a0c782a1fc89688fb5fd8d4ff44f4e47c
SHA-1: 08631a8ffd011226703ebd7941728cca627c505e
MD5: a58296e9ea95f8c30702451531cd437b
ssdeep: 768:8gGzpDOWhAt41Iuf0gbSlnq0ECTEizq0NCQaR0b7Ey995AXf+QYFoeE2MB1xyNGu:ZGFqzXNE4dzq0NiR0b7EOjAXf1B2MfUB
TLSH: T18D33AFF34047ED8C79CB6F036AAA005DB586D68C523796A055CC376CD4BC6EDAF01A60
Submitted as: ce14f3_5783a12c17b64f46ad61c82076bb3591.pdf
File type: pdf · Size: 48800 bytes
Verdict: malicious (88/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ttraff.com/wix?keyword=snow+blower+manual, https://cdn.shopify.com/s/files/1/0439/2520/9256/files/diagnostico_cancer_de_pulmao.pdf, https://cdn.shopify.com/s/files/1/0431/1344/7577/files/20023628727.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://ttraff.com/wix?keyword=snow+blower+manual
https://cdn.shopify.com/s/files/1/0439/2520/9256/files/diagnostico_cancer_de_pulmao.pdf
https://cdn.shopify.com/s/files/1/0431/1344/7577/files/20023628727.pdf
https://cdn.shopify.com/s/files/1/0431/3923/5997/files/criminal_law_text_cases_and_materials.pdf
https://cdn.shopify.com/s/files/1/0438/3234/4736/files/aws_pricing_calculator.pdf
https://06650e75-7858-4485-97f8-3c2293c0c102.filesusr.com/ugd/957c7b_0edf21953f46465f82058dfc9add139e.pdf?index=true
https://bd5c9b66-6b73-4f58-8440-a4458c49235c.filesusr.com/ugd/238140_f803f0409a814584b5108f5525fc89bb.pdf?index=true
https://e61de7bb-1c83-4091-b8fe-5563eae1f483.filesusr.com/ugd/f967ac_83f8065666564cd5adfceb853e444e97.pdf?index=true
https://293f0243-eb43-40e8-a6bf-7288d9b6a828.filesusr.com/ugd/e3ed1f_88f2df2d18e4400b81a003cb84f71418.pdf?index=true
https://cdn.shopify.com/s/files/1/0467/6032/9379/files/reporte_de_transito_autopista_mexico_queretaro.pdf
https://cdn.shopify.com/s/files/1/0431/1610/1793/files/63517425351.pdf
https://cdn.shopify.com/s/files/1/0432/0195/3952/files/grenada_lake_crappie_guides_brandon_fulgham.pdf
https://cdn.shopify.com/s/files/1/0436/2931/4206/files/how_to_raise_your_self_esteem.pdf
https://cdn.shopify.com/s/files/1/0449/5425/5515/files/check_cuda_version.pdf
https://cdn.shopify.com/s/files/1/0439/1269/1867/files/tafazesisax.pdf
https://cdn.shopify.com/s/files/1/0434/4178/2946/files/83668908673.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ttraff.com
cdn.shopify.com
06650e75-7858-4485-97f8-3c2293c0c102.filesusr.com
bd5c9b66-6b73-4f58-8440-a4458c49235c.filesusr.com
e61de7bb-1c83-4091-b8fe-5563eae1f483.filesusr.com
293f0243-eb43-40e8-a6bf-7288d9b6a828.filesusr.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report