MALICIOUS — 575363_8ba5a1df6af94cf39c86c73cd64bdb68.pdf

MALICIOUS — 575363_8ba5a1df6af94cf39c86c73cd64bdb68.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: a562cac0c07bded07d392dbffd91248828b4fd61c464b38b36c16b50fe32a50d
• SHA-1: ccc170cfaf21d1bf581dc72a20b3906eda1df230
• MD5: 1bded2f306ae88005884b5863352b265
• ssdeep: 1536:fGFV+ciYMbutRQ0XKTdTsQPQKhjwWvOn46rW+:OFV+ciwGsQRjun46/
• TLSH: T12034BEF31087ED8C3A8F5F03A9DB11286146D689313776B049AC7A6DD0BC6BDBE10921
• Submitted as: 575363_8ba5a1df6af94cf39c86c73cd64bdb68.pdf
• File type: pdf · Size: 53737 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=download+mx+player+pro+apkmos, https://d522f603-8341-4957-8ca8-22daf348534a.filesusr.com/ugd/eb6612_861f506771ef46f383022850a081eeb6.pdf?index=true, https://54ff2955-3141-4b41-ac3b-48a91df226ab.filesusr.com/ugd/64bd79_1ede0eb3b4b843b9afeb0769c93a51ff.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=download+mx+player+pro+apkmos
• https://d522f603-8341-4957-8ca8-22daf348534a.filesusr.com/ugd/eb6612_861f506771ef46f383022850a081eeb6.pdf?index=true
• https://54ff2955-3141-4b41-ac3b-48a91df226ab.filesusr.com/ugd/64bd79_1ede0eb3b4b843b9afeb0769c93a51ff.pdf?index=true
• https://13a9eee8-a06c-4474-ab37-0ad5ad202ed0.filesusr.com/ugd/bba345_aef1ae9a44194917a8e8b434494c01b1.pdf?index=true
• https://d633090a-0370-49ee-a364-178749e79d15.filesusr.com/ugd/f6336d_a76d36da138d446ab5659af3444a78b3.pdf?index=true
• https://96a5c991-cbdd-4c0a-9ac4-ba399eebeab6.filesusr.com/ugd/668a47_fb66f3b0e32d44b69de7b59389b3e291.pdf?index=true
• https://a6c1b372-a7e7-48af-bdf8-c6830b879c2a.filesusr.com/ugd/48bf55_510a56eb3def4eb18057b1b686566a8b.pdf?index=true
• https://8347e82f-fc3f-457f-9ac5-1d7e629de248.filesusr.com/ugd/bfbc46_47e6243074824f0f89135cdef76ce442.pdf?index=true
• https://094d357d-5e35-4687-8a27-c4a794d4f0ea.filesusr.com/ugd/94e5ef_43461c98ccae4f87a6869d8191d4ffb1.pdf?index=true
• https://6efa8ff2-0e90-409d-9183-3479277e7ddb.filesusr.com/ugd/221eaa_692a2e879848409bb5b5a0655187830a.pdf?index=true
• https://1397c80b-2ea8-4252-89de-2014b0180fa5.filesusr.com/ugd/8a9bcc_a05d4da6bb7f4b5388e11b4edb63592a.pdf?index=true
• https://cdn.shopify.com/s/files/1/0460/1158/0575/files/ghatna_chakra_geography_2018_in_english.pdf
• https://cdn.shopify.com/s/files/1/0433/0687/7080/files/pinabazebovo.pdf
• https://cdn.shopify.com/s/files/1/0430/9096/8729/files/zomutenexisapaxupunifemil.pdf
• https://cdn.shopify.com/s/files/1/0428/9658/8967/files/jewish_cooperative_school.pdf
• https://cdn.shopify.com/s/files/1/0431/0866/3456/files/30609496954.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• d522f603-8341-4957-8ca8-22daf348534a.filesusr.com
• 54ff2955-3141-4b41-ac3b-48a91df226ab.filesusr.com
• 13a9eee8-a06c-4474-ab37-0ad5ad202ed0.filesusr.com
• d633090a-0370-49ee-a364-178749e79d15.filesusr.com
• 96a5c991-cbdd-4c0a-9ac4-ba399eebeab6.filesusr.com
• a6c1b372-a7e7-48af-bdf8-c6830b879c2a.filesusr.com
• 8347e82f-fc3f-457f-9ac5-1d7e629de248.filesusr.com
• 094d357d-5e35-4687-8a27-c4a794d4f0ea.filesusr.com
• 6efa8ff2-0e90-409d-9183-3479277e7ddb.filesusr.com
• 1397c80b-2ea8-4252-89de-2014b0180fa5.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report