MALICIOUS — e50c99_c2cffeaf8be9471e82d44fd398939a95.pdf

MALICIOUS — e50c99_c2cffeaf8be9471e82d44fd398939a95.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: b5f4ac6522a9d0addc8936947906e915e0eaa2d98734c98c5b8333e87080a940
• SHA-1: 04f2a58928dfcacf13075d5d235550a3fd109fea
• MD5: 16f90a6d4a400d4eff23bb4c0cc50cc1
• ssdeep: 768:cgGzpDxQxFZ9HwqLPuFToLqse/pKZU36Grq9SgA//i5i9abc90RJiUxkk:5GF1QLupK+qGySgAS58Qci3i6kk
• TLSH: T19A34BFF31057CC8D66CAAB47AAA7109DB495D2C9303255641CECB66CC0787FD7E20960
• Submitted as: e50c99_c2cffeaf8be9471e82d44fd398939a95.pdf
• File type: pdf · Size: 53573 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=august+2014+geometry+regents+answers, https://1f89eb0f-5c44-42b4-aaae-85971dc318c3.filesusr.com/ugd/60ffa2_2dc194f1b22442779bd4c9161d351a9b.pdf?index=true, https://d81ae801-0a3a-4e0c-8b2a-9d889e436070.filesusr.com/ugd/dfb5f8_c6a642925d8044879ace0dd70d468c23.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=august+2014+geometry+regents+answers
• https://1f89eb0f-5c44-42b4-aaae-85971dc318c3.filesusr.com/ugd/60ffa2_2dc194f1b22442779bd4c9161d351a9b.pdf?index=true
• https://d81ae801-0a3a-4e0c-8b2a-9d889e436070.filesusr.com/ugd/dfb5f8_c6a642925d8044879ace0dd70d468c23.pdf?index=true
• https://c2c20907-8900-4c30-8fe3-9568e24a452f.filesusr.com/ugd/2486b5_6367b4d7f6464b51b6b919d98be2ac72.pdf?index=true
• https://cdn.shopify.com/s/files/1/0430/0367/4785/files/xoporeruramufanadasumani.pdf
• https://cdn.shopify.com/s/files/1/0432/0120/0288/files/wisdom_books_of_the_bible.pdf
• https://cdn.shopify.com/s/files/1/0429/6287/8618/files/finisunotos.pdf
• https://cdn.shopify.com/s/files/1/0431/5525/9546/files/runepizijipugutimapija.pdf
• https://cdn.shopify.com/s/files/1/0429/4151/3894/files/rewuxipivikodugovit.pdf
• https://cdn.shopify.com/s/files/1/0429/2483/4982/files/52402511769.pdf
• https://cdn.shopify.com/s/files/1/0431/6410/6909/files/kodupogumolubox.pdf
• https://7a6bc573-5a49-4060-98d5-db474974d47b.filesusr.com/ugd/384ea4_38963b02758444829ffcb190706db190.pdf?index=true
• https://b984e060-d088-4330-ab29-fe688bacc2ac.filesusr.com/ugd/610d21_583f4282ca8b4bf0a3be6719c02537c1.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• 1f89eb0f-5c44-42b4-aaae-85971dc318c3.filesusr.com
• d81ae801-0a3a-4e0c-8b2a-9d889e436070.filesusr.com
• c2c20907-8900-4c30-8fe3-9568e24a452f.filesusr.com
• cdn.shopify.com
• 7a6bc573-5a49-4060-98d5-db474974d47b.filesusr.com
• b984e060-d088-4330-ab29-fe688bacc2ac.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report