MALICIOUS — d775a9_5d12e34c861e478e839a36100feee094.pdf

MALICIOUS — d775a9_5d12e34c861e478e839a36100feee094.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: b745327b6c3f582ea96b68eb34aea59e638317a067a8346971829dea776e5813
• SHA-1: abf18cb8474da15223716c681c4aac799682732f
• MD5: 65010a8dc3697deb1cf131b782d22065
• ssdeep: 768:vgGzpDVDAlIW1NO6kIXvGZHgtDinhJhcDKdUHt9oHlT2JGGWn7tLUInm:YGFJ0cbEKTHlT2JQFUcm
• TLSH: T176307DF750A7EC8E7B8E5F036E97008E9589DA8D6032A2A05098377CD47CAFD6F10951
• Submitted as: d775a9_5d12e34c861e478e839a36100feee094.pdf
• File type: pdf · Size: 37325 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=industrial+electrical+supply+brooklyn, https://cdn.shopify.com/s/files/1/0437/2830/6341/files/rewrite_the_stars_sheet_music_piano_easy.pdf, https://cdn.shopify.com/s/files/1/0429/9682/6273/files/vawaneburum.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=industrial+electrical+supply+brooklyn
• https://cdn.shopify.com/s/files/1/0437/2830/6341/files/rewrite_the_stars_sheet_music_piano_easy.pdf
• https://cdn.shopify.com/s/files/1/0429/9682/6273/files/vawaneburum.pdf
• https://cdn.shopify.com/s/files/1/0462/8709/3920/files/nintendo_3ds_capture_card_loopy.pdf
• https://cdn.shopify.com/s/files/1/0437/6900/4190/files/annual_report_akasha_wira_international_2013.pdf
• https://cdn.shopify.com/s/files/1/0464/8658/5512/files/4961992616.pdf
• https://54aaf7be-4a87-4ddf-b43c-e4b89d4da31e.filesusr.com/ugd/2b3f46_1230e22574e34d199a39e39cec1cd219.pdf?index=true
• https://9b6ba4a1-331d-4003-ace1-7f4373fea6cd.filesusr.com/ugd/5b5da7_029624bee537465c98e7b44bccca6d65.pdf?index=true
• https://c5953c82-9bc5-4bb0-92a7-dac7edc0254c.filesusr.com/ugd/60e703_e39f1b09dfb14b45a97d558d9bda6e03.pdf?index=true
• https://ebf7b625-1c4f-468c-bdc5-442d60e52be9.filesusr.com/ugd/436160_1e1fdb10c08d4894b56b2ab39d78b1dd.pdf?index=true
• https://2e2f7a19-b016-4519-bf7c-dac2b0da2e04.filesusr.com/ugd/850f07_ceb5ceafe5a14d1091f71cc7980fc5ba.pdf?index=true
• https://cdn.shopify.com/s/files/1/0441/4432/8856/files/two_hands_one_heart_chords.pdf
• https://cdn.shopify.com/s/files/1/0429/4708/4447/files/gamma_binaural_beats.pdf
• https://cdn.shopify.com/s/files/1/0484/4712/7720/files/zejezubigelixo.pdf
• https://cdn.shopify.com/s/files/1/0458/6022/5177/files/the_legend_of_bagger_vance_music.pdf
• https://cdn.shopify.com/s/files/1/0427/6341/9815/files/mevata.pdf
• https://cdn.shopify.com/s/files/1/0436/9989/6475/files/dapekomugumumagowosijejax.pdf
• https://cdn.shopify.com/s/files/1/0452/5893/2381/files/walibuzunidigakunav.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• cdn.shopify.com
• 54aaf7be-4a87-4ddf-b43c-e4b89d4da31e.filesusr.com
• 9b6ba4a1-331d-4003-ace1-7f4373fea6cd.filesusr.com
• c5953c82-9bc5-4bb0-92a7-dac7edc0254c.filesusr.com
• ebf7b625-1c4f-468c-bdc5-442d60e52be9.filesusr.com
• 2e2f7a19-b016-4519-bf7c-dac2b0da2e04.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report