MALICIOUS — 17ce20_864c3f20a9f041d4b4fbcaba14e3a993.pdf

MALICIOUS — 17ce20_864c3f20a9f041d4b4fbcaba14e3a993.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: c1a93004a88f7b99d11a26ec21689aadba0475f33701bd4b5fa059537d561a9a
• SHA-1: 425bd699eeec1c0d0f6f39040bf7b79921a12b64
• MD5: b3d9ea54bf32c8a2595362031fdac625
• ssdeep: 1536:iGF9S28FYwrc6pIIZwWsZbzlJsrwQxdnGCXUAZ6MoONahgcGsKUXx64NhZFrKx:bF9S2SrcF/vqvdnGiDUhg5sKG64NvZ8
• TLSH: T14239E1F320B7ED182643AF43ACEB65499095D78D11366AB8958C376CC8BC3BE2E10570
• Submitted as: 17ce20_864c3f20a9f041d4b4fbcaba14e3a993.pdf
• File type: pdf · Size: 91946 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=neon+racing+2+unblocked, https://547f4891-31ef-4ea4-904f-eb4154ddd12c.filesusr.com/ugd/3bcfef_1f86e622e50d43aba707296acea581eb.pdf?index=true, https://4f72bf25-f470-4974-b254-9900c9c18868.filesusr.com/ugd/3ed902_e167c1dc569f4e959a5577f3861aab0a.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=neon+racing+2+unblocked
• https://547f4891-31ef-4ea4-904f-eb4154ddd12c.filesusr.com/ugd/3bcfef_1f86e622e50d43aba707296acea581eb.pdf?index=true
• https://4f72bf25-f470-4974-b254-9900c9c18868.filesusr.com/ugd/3ed902_e167c1dc569f4e959a5577f3861aab0a.pdf?index=true
• https://54ce31c7-33fe-489d-b92f-f8be918dbbe2.filesusr.com/ugd/3a38e0_85809577ab3841a7bb335f247a82b0af.pdf?index=true
• http://files.petoskeycenter.com/uploads/1/3/2/6/132681556/tizokonadad.pdf
• http://files.southernperfection.com/uploads/1/3/2/6/132680922/xoxupepar_vanotum.pdf
• http://ridulasur.learningcafe.us/uploads/1/3/1/3/131378776/zaxozirivagijimip.pdf
• http://files.mairibudreau.com/uploads/1/3/0/7/130776864/ziwawajobigogefivane.pdf
• http://files.marilynoconnell.com/uploads/1/3/1/4/131452836/kovamebiragifem_dovitu_wojedodek.pdf
• https://8f575a42-aa71-41d0-83f7-f813fb0e8fa8.filesusr.com/ugd/e3c460_c109fe13e3ca4249a52ed3fb8e6f5604.pdf?index=true
• https://2e555c66-c733-4bda-8595-e34f8dd3db30.filesusr.com/ugd/d43733_d835b02a09dc4030b8f9c82b8828b194.pdf?index=true
• https://ed57cfd6-ad8d-43fa-9f16-f4bb94bba532.filesusr.com/ugd/dc8a8e_235864fb0c274cbc9e6883c4fc520cc5.pdf?index=true
• https://8e234661-ca54-4c14-8b87-817cc5fd600e.filesusr.com/ugd/fedf23_4d76974537fb4e6e85c3de631a23ede7.pdf?index=true
• https://026a83a8-73dc-47ed-a7c4-00dd87cb46ac.filesusr.com/ugd/314c35_aaf6323d9d5f443fbb7364bae960387e.pdf?index=true
• https://bb3b5b9f-3461-451f-aee4-1bff73bcb2c6.filesusr.com/ugd/5f5755_16e26bbee8974794963b338554327192.pdf?index=true
• https://0fa96eaf-e02c-4867-8cf3-d30680208650.filesusr.com/ugd/3e7897_eb4d8a6a6666451b8b0a9daf7091cbfa.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• 547f4891-31ef-4ea4-904f-eb4154ddd12c.filesusr.com
• 4f72bf25-f470-4974-b254-9900c9c18868.filesusr.com
• 54ce31c7-33fe-489d-b92f-f8be918dbbe2.filesusr.com
• files.petoskeycenter.com
• files.southernperfection.com
• ridulasur.learningcafe.us
• files.mairibudreau.com
• files.marilynoconnell.com
• 8f575a42-aa71-41d0-83f7-f813fb0e8fa8.filesusr.com
• 2e555c66-c733-4bda-8595-e34f8dd3db30.filesusr.com
• ed57cfd6-ad8d-43fa-9f16-f4bb94bba532.filesusr.com
• 8e234661-ca54-4c14-8b87-817cc5fd600e.filesusr.com
• 026a83a8-73dc-47ed-a7c4-00dd87cb46ac.filesusr.com
• bb3b5b9f-3461-451f-aee4-1bff73bcb2c6.filesusr.com
• 0fa96eaf-e02c-4867-8cf3-d30680208650.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report