MALICIOUS — 610d21_50e7b275308344ea82075e6e49b5d1cc.pdf

MALICIOUS — 610d21_50e7b275308344ea82075e6e49b5d1cc.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: ccb9e5a063ac11b47c4abe0e73cbce387707856f31bb5b062c9d22db3a7df5ff
• SHA-1: 412bc37ee2c4cbed275a560ed6e5d9cb02c5d1bb
• MD5: a7b195e73d8cd8cb77b9640030084edb
• ssdeep: 768:SgGzpDi52d7EUMgmlH9fopvl44nw2F7FjVbiiH7V6o7V97V28j:PGFuVH9fkvlrw2Fx9HR6oR9RVj
• TLSH: T11D309EF36497ED8C7A829B036DE201556086D78D6123AB60188C7B2CD8BC6FC7F50961
• Submitted as: 610d21_50e7b275308344ea82075e6e49b5d1cc.pdf
• File type: pdf · Size: 38413 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=bolt+fitness+dumbbells, https://cdn.shopify.com/s/files/1/0431/6997/2384/files/micromedia_flash_pro_8.pdf, https://cdn.shopify.com/s/files/1/0430/1812/5465/files/california_regions_map.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=bolt+fitness+dumbbells
• https://cdn.shopify.com/s/files/1/0431/6997/2384/files/micromedia_flash_pro_8.pdf
• https://cdn.shopify.com/s/files/1/0430/1812/5465/files/california_regions_map.pdf
• https://cdn.shopify.com/s/files/1/0431/4162/8072/files/83850420362.pdf
• https://cdn.shopify.com/s/files/1/0433/0687/7080/files/nunixa.pdf
• http://detozen.perfectionbrafitting.com/uploads/1/3/0/7/130776791/b664df01d.pdf
• https://cdn.shopify.com/s/files/1/0435/6915/2163/files/cv_automatisme_et_informatique_industrielle.pdf
• https://cdn.shopify.com/s/files/1/0435/2085/2122/files/86563236992.pdf
• https://cdn.shopify.com/s/files/1/0434/6894/7616/files/atoms_and_molecules_worksheet_8th_grade.pdf
• https://b2d8a6f3-a2d9-4a32-a680-f691c713f2ab.filesusr.com/ugd/8a4248_8ab3b4bb4aa1418f88c58cd7325bf5a9.pdf?index=true
• https://13cffb50-6487-473f-b227-07ba93cfabd1.filesusr.com/ugd/0286dd_4365b4cfc1e64dbebb43509437884e85.pdf?index=true
• https://0cbeab6e-4304-4462-8e19-440cb55feb68.filesusr.com/ugd/d7d6cd_94b5a57ae946413cb7eab67bc865d2b1.pdf?index=true
• https://5cf58a63-6758-472c-a608-fb5cfa0afec7.filesusr.com/ugd/dba42a_65320b6b2ec1441e9c7b2df367c11c2d.pdf?index=true
• https://c1e547c0-3713-4b67-b3f6-36374ca2d452.filesusr.com/ugd/8a9bcc_7c884e09af0f41c39c870b117ed8d4ee.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• cdn.shopify.com
• detozen.perfectionbrafitting.com
• b2d8a6f3-a2d9-4a32-a680-f691c713f2ab.filesusr.com
• 13cffb50-6487-473f-b227-07ba93cfabd1.filesusr.com
• 0cbeab6e-4304-4462-8e19-440cb55feb68.filesusr.com
• 5cf58a63-6758-472c-a608-fb5cfa0afec7.filesusr.com
• c1e547c0-3713-4b67-b3f6-36374ca2d452.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report