MALICIOUS — 370ea2_b39c4809d00347498279691d3579e0e3.pdf

MALICIOUS — 370ea2_b39c4809d00347498279691d3579e0e3.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: a7c903db1327906699f35343dd30102718d07ab67596aef5173338fbbf80bce0
• SHA-1: 78c7830d59578a4fafa085bc80a5588e432cdc9f
• MD5: 6dfcacefce88b33bc5b6a43e0a1df915
• ssdeep: 1536:rGF/YnZMlpoJn5Cc+N6B4+r4ElPZ/OLP:KF/yTBf4A/W
• TLSH: T1F534BFF35597EC8C77CB6F036CE621591146C74962329BA088CCBBADC4BC1BD6E90921
• Submitted as: 370ea2_b39c4809d00347498279691d3579e0e3.pdf
• File type: pdf · Size: 53134 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=david+rossi+lapd, https://f457472c-153e-479e-801e-e8b558f45222.filesusr.com/ugd/440e29_7f67a8eb58fc4ee295e492925b91430e.pdf?index=true, https://056f7d84-bc55-4c5a-921f-9d3d356a2a18.filesusr.com/ugd/9cfd0a_42a2ce1c010a4cd6ac3f62c9dabd50f6.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=david+rossi+lapd
• https://f457472c-153e-479e-801e-e8b558f45222.filesusr.com/ugd/440e29_7f67a8eb58fc4ee295e492925b91430e.pdf?index=true
• https://056f7d84-bc55-4c5a-921f-9d3d356a2a18.filesusr.com/ugd/9cfd0a_42a2ce1c010a4cd6ac3f62c9dabd50f6.pdf?index=true
• https://3b1abf75-1a7b-406d-a9cb-a4a54acb54d4.filesusr.com/ugd/5ea691_87ac5379ee0d44a492bbcbe705f3fd37.pdf?index=true
• https://0d9e6537-3130-4746-aea7-c2645db74d5b.filesusr.com/ugd/0582e0_680d2328712f4e36b3ab0c2110483e16.pdf?index=true
• https://82137b76-225a-4757-8729-0ebe6a481922.filesusr.com/ugd/70e7d4_2924701c98674df1888078fd40a3829a.pdf?index=true
• https://57d0ae8f-5b56-4cd3-a599-a8fcf535d502.filesusr.com/ugd/f4de5e_8cb2086a86ba4e1487a887d9757b53b8.pdf?index=true
• https://10f6cae8-3205-416d-bdfe-15e09509b0d9.filesusr.com/ugd/8e7730_d0f6698e6ef84267aafb6f79db8a9d5b.pdf?index=true
• https://e441ecf9-053b-4b49-a274-606160233614.filesusr.com/ugd/69695d_7e1c66f336c24001adbd74fca563cd6b.pdf?index=true
• https://9e8c42aa-5b52-49e1-8555-702460132a66.filesusr.com/ugd/3bf302_812d3ad077604a6289dd07c1d252ef82.pdf?index=true
• https://d7a78d61-440c-4987-b9a8-9873fa0620e0.filesusr.com/ugd/8da65f_1acf78e4f4704bf397aa62dfba0a9270.pdf?index=true
• https://4afddc1a-3893-4bcd-aeb0-dba9d3ccc8dc.filesusr.com/ugd/b42fd6_c1580c405223447292c78cb78bae4e2e.pdf?index=true
• https://c4eb01f7-5d26-4dec-b54c-a082e26ce542.filesusr.com/ugd/38062a_e3dd3bb13a354ec8bc23b80cabe990a2.pdf?index=true
• https://59b3bd42-89ed-40df-ae5e-f0cb3d73e663.filesusr.com/ugd/5ea691_9777379ad7184cdcaff9d3c09325c513.pdf?index=true
• https://cdac4156-b7d9-489e-9593-ca425761cd85.filesusr.com/ugd/3283b0_fa312b622cd94a5098914b4130d1bdaf.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• f457472c-153e-479e-801e-e8b558f45222.filesusr.com
• 056f7d84-bc55-4c5a-921f-9d3d356a2a18.filesusr.com
• 3b1abf75-1a7b-406d-a9cb-a4a54acb54d4.filesusr.com
• 0d9e6537-3130-4746-aea7-c2645db74d5b.filesusr.com
• 82137b76-225a-4757-8729-0ebe6a481922.filesusr.com
• 57d0ae8f-5b56-4cd3-a599-a8fcf535d502.filesusr.com
• 10f6cae8-3205-416d-bdfe-15e09509b0d9.filesusr.com
• e441ecf9-053b-4b49-a274-606160233614.filesusr.com
• 9e8c42aa-5b52-49e1-8555-702460132a66.filesusr.com
• d7a78d61-440c-4987-b9a8-9873fa0620e0.filesusr.com
• 4afddc1a-3893-4bcd-aeb0-dba9d3ccc8dc.filesusr.com
• c4eb01f7-5d26-4dec-b54c-a082e26ce542.filesusr.com
• 59b3bd42-89ed-40df-ae5e-f0cb3d73e663.filesusr.com
• cdac4156-b7d9-489e-9593-ca425761cd85.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report