MALICIOUS — 3835dd_2a1e53a773ca4d38b931737092c9823d.pdf

MALICIOUS — 3835dd_2a1e53a773ca4d38b931737092c9823d.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: a8b8b24be2a9a8b75f5e323c9eb79ce3ad0a2f504dbed37ece4cecea23785b57
• SHA-1: 3bfedebc24915b9a0e1450c87bb976435f24475d
• MD5: b395687cfc45f7b70d1565c472157670
• ssdeep: 1536:IGFyJj8rDdiO8mwmOYEt2q3YybASicBXXki:lFyR8rDdiO8luEt28/ASiAt
• TLSH: T1DE34AEF3406BECC876C66B5778E210687042DA896137A6D444CC7B7CD8787ECAE50BA1
• Submitted as: 3835dd_2a1e53a773ca4d38b931737092c9823d.pdf
• File type: pdf · Size: 55127 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=baka+tsuki+shinmai+maou+no+testament+sub+indo, https://cdn.shopify.com/s/files/1/0437/0500/8293/files/nulufodowateli.pdf, https://cdn.shopify.com/s/files/1/0432/1896/0545/files/sample_cv_for_job_application_template.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=baka+tsuki+shinmai+maou+no+testament+sub+indo
• https://cdn.shopify.com/s/files/1/0437/0500/8293/files/nulufodowateli.pdf
• https://cdn.shopify.com/s/files/1/0432/1896/0545/files/sample_cv_for_job_application_template.pdf
• https://cdn.shopify.com/s/files/1/0435/7062/6723/files/95210301622.pdf
• https://cdn.shopify.com/s/files/1/0429/8440/7199/files/gene_and_chromosome_mutation_worksheet_answers.pdf
• https://cdn.shopify.com/s/files/1/0433/0012/6885/files/adolescent_social_development.pdf
• https://cdn.shopify.com/s/files/1/0437/7447/6440/files/delectable_education_curriculum_template_review.pdf
• https://28f42826-49c4-44f2-afc0-0b306e022e28.filesusr.com/ugd/6f9b04_5d404fde318c4463b101514db6007311.pdf?index=true
• https://a519ada6-c0c1-4e52-afb8-420e29dbc1b3.filesusr.com/ugd/610d21_c29222ecd3834f4795a23641afea2ae5.pdf?index=true
• https://ea11ad54-7b84-4292-852b-874b8f83162c.filesusr.com/ugd/bba345_206bd5e73c7d43349f5b82f6fd474271.pdf?index=true
• https://47e8dd91-6b58-4be5-bf1f-e0e1b981c1e2.filesusr.com/ugd/95089d_df2f087e2516476284f5b037242d03c6.pdf?index=true
• https://8f33a481-cece-4811-a6d6-28cedb1a338b.filesusr.com/ugd/110ef3_4e9286fb94054995b45370bf38904395.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• cdn.shopify.com
• 28f42826-49c4-44f2-afc0-0b306e022e28.filesusr.com
• a519ada6-c0c1-4e52-afb8-420e29dbc1b3.filesusr.com
• ea11ad54-7b84-4292-852b-874b8f83162c.filesusr.com
• 47e8dd91-6b58-4be5-bf1f-e0e1b981c1e2.filesusr.com
• 8f33a481-cece-4811-a6d6-28cedb1a338b.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report