MALICIOUS — 7f614e_b503e80fd5794c498fbd11e1207b96bb.pdf

MALICIOUS — 7f614e_b503e80fd5794c498fbd11e1207b96bb.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: b4b240d9256d2525810413a427b68b191aa36ba4895a5fa096c85b4a879e48f6
• SHA-1: c24b024ca323cf28c17b93da598e4fd7d617c8dd
• MD5: ee178048e9c2099dad6dbea7c9e0f382
• ssdeep: 768:lgGzpD5v1QhDo1/Z9qsMqSGB96Uht7LCC5O49YXH2csNe7e0Gzy7KqCX:2GF1f9SGB8UHr9k2cJy3W9CX
• TLSH: T10D33BEF30057DD8CAB9FAF436AAB04686546DA8D7122E76415CCB67CC07C6BC7E00A61
• Submitted as: 7f614e_b503e80fd5794c498fbd11e1207b96bb.pdf
• File type: pdf · Size: 47790 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=hit+dice+5e+level+up, https://cdn.shopify.com/s/files/1/0428/7568/2972/files/built_to_last_successful_habits_of_visionary_companies_summary.pdf, https://cdn.shopify.com/s/files/1/0433/3853/0965/files/ball_bearing_skf.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=hit+dice+5e+level+up
• https://cdn.shopify.com/s/files/1/0428/7568/2972/files/built_to_last_successful_habits_of_visionary_companies_summary.pdf
• https://cdn.shopify.com/s/files/1/0433/3853/0965/files/ball_bearing_skf.pdf
• https://cdn.shopify.com/s/files/1/0447/8572/9685/files/the_economist_magazine_www._magazinelib._com.pdf
• https://cdn.shopify.com/s/files/1/0433/7365/8273/files/10922155337.pdf
• https://cdn.shopify.com/s/files/1/0431/1197/3026/files/codehs_python_quiz_answers.pdf
• https://cdn.shopify.com/s/files/1/0430/4207/8877/files/26958905834.pdf
• https://cdn.shopify.com/s/files/1/0427/4782/2236/files/xuvubusupemasazisus.pdf
• https://cdn.shopify.com/s/files/1/0428/9835/8432/files/28821374719.pdf
• https://cdn.shopify.com/s/files/1/0432/7686/1606/files/formato_de_amparo_directo_en_materia_laboral.pdf
• https://cdn.shopify.com/s/files/1/0435/3851/4071/files/akreditasi_universitas_indonesia.pdf
• https://77848084-a3db-4d1f-9d2e-afab50f7524c.filesusr.com/ugd/9058e5_9e5f583cdff146dc9ae408aab64fd964.pdf?index=true
• https://872184f7-10ca-40da-8e7c-bfcb654e844b.filesusr.com/ugd/a2ebd8_2b57a020d5934b5a95c07a42b69fab37.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• cdn.shopify.com
• 77848084-a3db-4d1f-9d2e-afab50f7524c.filesusr.com
• 872184f7-10ca-40da-8e7c-bfcb654e844b.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report