MALICIOUS — e6092c_fa0b22d797094a6b870120873d7e47e3.pdf

MALICIOUS — e6092c_fa0b22d797094a6b870120873d7e47e3.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: f51eecbaf78399aaa357b746db753c5ae43be0413b1754566efb225246f462ec
• SHA-1: 857216e0ce35aa34b55d2c0b8c8a7b5d69d0088d
• MD5: 37ee8d3b391e97714b0d2a47e633b623
• ssdeep: 1536:DGFBg8bT9G0d0vfvzTznQxeN8SQhPLUkbgrK8d8m0KJd6tlUcK4:SFBXrMf7Ax0FqdkFqm0KJAwI
• TLSH: T1C937BFF340D7EC497A9BAF139CEA21556181CACD6067AB5040D8376CC9782FDBF50A21
• Submitted as: e6092c_fa0b22d797094a6b870120873d7e47e3.pdf
• File type: pdf · Size: 71993 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=one+big+party+worksheet+icivics, https://cdn.shopify.com/s/files/1/0429/6772/8281/files/jabog.pdf, https://cdn.shopify.com/s/files/1/0429/4190/7100/files/71807899217.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=one+big+party+worksheet+icivics
• https://cdn.shopify.com/s/files/1/0429/6772/8281/files/jabog.pdf
• https://cdn.shopify.com/s/files/1/0429/4190/7100/files/71807899217.pdf
• https://cdn.shopify.com/s/files/1/0433/3427/1126/files/sitodovowuvalowutinodexer.pdf
• https://cdn.shopify.com/s/files/1/0429/5409/6806/files/22330676984.pdf
• https://cdn.shopify.com/s/files/1/0433/8266/9464/files/ellen_book_seriously_im_kidding.pdf
• https://cdn.shopify.com/s/files/1/0433/3748/2405/files/nazozuzugolajoniwafireti.pdf
• https://cdn.shopify.com/s/files/1/0432/8570/8968/files/sibepunu.pdf
• https://8ac080d6-5809-4c33-91b6-af612b6202c7.filesusr.com/ugd/d5cf39_b4389c6d87c744f2a5197a494e797280.pdf?index=true
• https://d4cfd8db-457e-4917-b4b0-99950df29024.filesusr.com/ugd/595093_a67c2f042cca4639bcb2d08e11dde838.pdf?index=true
• https://db58a6a0-6ff4-499d-80ec-dea5386fbbff.filesusr.com/ugd/3225da_9ae6e92044654c36ab2395bd1f33855c.pdf?index=true
• https://70571239-955e-439c-a5d4-0c27495d2b60.filesusr.com/ugd/e6092c_ed52ae6d50704904a21d12f3df23cfee.pdf?index=true
• https://35ac671e-8e48-436c-98ad-f1555f21c9c6.filesusr.com/ugd/0789d5_2fa2147cfc534f2893cc204ca9def115.pdf?index=true
• https://219abeb6-d6fe-4f58-826d-42785e5e0345.filesusr.com/ugd/067ecb_bd8e73dc80d44bbcbccfae910081058a.pdf?index=true
• https://405a454a-892b-48b4-8a44-ee5b4573318e.filesusr.com/ugd/bba345_c9716754f9694abbbd15e0c058a7d479.pdf?index=true
• https://5c6a6ad6-8f32-4bab-a217-6ad98cf4ab42.filesusr.com/ugd/e3c460_bfc88d520ac34b2791fd497315bba3ca.pdf?index=true
• https://950f9f04-f8d9-44ad-9a04-beaeb4cea640.filesusr.com/ugd/cacfd7_61982d69ca3748138636bbd6065c1ba2.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• cdn.shopify.com
• 8ac080d6-5809-4c33-91b6-af612b6202c7.filesusr.com
• d4cfd8db-457e-4917-b4b0-99950df29024.filesusr.com
• db58a6a0-6ff4-499d-80ec-dea5386fbbff.filesusr.com
• 70571239-955e-439c-a5d4-0c27495d2b60.filesusr.com
• 35ac671e-8e48-436c-98ad-f1555f21c9c6.filesusr.com
• 219abeb6-d6fe-4f58-826d-42785e5e0345.filesusr.com
• 405a454a-892b-48b4-8a44-ee5b4573318e.filesusr.com
• 5c6a6ad6-8f32-4bab-a217-6ad98cf4ab42.filesusr.com
• 950f9f04-f8d9-44ad-9a04-beaeb4cea640.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report