MALICIOUS — dc6899_59875b29af914628be6df21b45b61b45.pdf
MALICIOUS — dc6899_59875b29af914628be6df21b45b61b45.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
fed3be01d55c8a6917dc1152ff5280ae4da71c842d3c504977e4b3724ee99c48 - SHA-1:
2e6b6efd44c475dd668dc1bd03897bae483fe393 - MD5:
072234784c6f15270a7f70dbeb0b6433 - ssdeep:
768:9gGzpD/P0+iU5cQXWGUQ6q3uqfNNLXxjhIsOf8uoIsiN4iE+ophotOpaOtRCskYl:+GFz9aQZHFNLh1IsK4iMcOtQ/p6F9Rf - TLSH:
T12235AEF35157DC4C3BCAAB4374EA2029A149EB8D3132E66454D87B6CC47C7BDAE50A20 - Submitted as: dc6899_59875b29af914628be6df21b45b61b45.pdf
- File type: pdf · Size: 57598 bytes
- Verdict: malicious (78/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The malicious score of 78/100 is the fusion of 5 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ttraff.club/wix?keyword=mahendra+st+portal+forgot+password, https://cdn.shopify.com/s/files/1/0429/2768/5788/files/88784202247.pdf, https://cdn.shopify.com/s/files/1/0438/1478/1088/files/92976110203.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.club/wix?keyword=mahendra+st+portal+forgot+password
- https://cdn.shopify.com/s/files/1/0482/5386/2049/files/uk_address_format_apartment.pdf
- https://cdn.shopify.com/s/files/1/0429/2768/5788/files/88784202247.pdf
- https://cdn.shopify.com/s/files/1/0438/1478/1088/files/92976110203.pdf
- https://cdn.shopify.com/s/files/1/0432/1030/9787/files/lab_safety_manual_template.pdf
- https://723f7b05-4690-41af-9f2c-305c966e8e53.filesusr.com/ugd/e50c99_a387c04fbd4941158676a518a50c7ba6.pdf?index=true
- https://38f20773-75da-4e02-8a40-934bf615f82a.filesusr.com/ugd/64bd79_0d5c72a273d14210a21fe11d83d825c6.pdf?index=true
- https://7ba6101a-5764-498f-8bc9-9acb8659e08d.filesusr.com/ugd/33a16d_ea67e415f79b4306a41427a582455714.pdf?index=true
- https://81dcb41d-3826-4f4c-981a-d2469a70dee7.filesusr.com/ugd/1e557c_56ddec18ca744903b35ddc9c612c55d1.pdf?index=true
- https://07ed169d-f166-451b-86fe-9bac6989c938.filesusr.com/ugd/54dfea_93b57c22c4ac49b498c384fa1caed2d0.pdf?index=true
- https://ffb8412e-6a8a-420e-aeff-9e660079a815.filesusr.com/ugd/04c368_6e3b259db3024fdeb172266861a7347e.pdf?index=true
- https://8f86e8ce-ffe8-4fe9-a03f-68bdc88f3698.filesusr.com/ugd/9c8fb9_40cf55ccfec8462e85607893d4d37817.pdf?index=true
- https://dea7fad3-7bf5-4b56-815a-d0bda601a5bf.filesusr.com/ugd/f3bfbb_7aee0376fd3746adb297b17bd3262d50.pdf?index=true
- https://fc4539c5-90d7-4be8-8cdb-d5748d9d6e9e.filesusr.com/ugd/384ea4_26dc5a089e5b4f98877a6d2d1494d384.pdf?index=true
- https://cdn.shopify.com/s/files/1/0438/7582/7867/files/6709672113.pdf
- https://cdn.shopify.com/s/files/1/0466/3243/5877/files/ap_calculus_ab_differentiation_worksheet.pdf
- https://cdn.shopify.com/s/files/1/0437/1460/9303/files/46900984295.pdf
- https://stportal.mahendras.org/login.aspx?ReturnUrl=%2F
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ttraff.club
- cdn.shopify.com
- 723f7b05-4690-41af-9f2c-305c966e8e53.filesusr.com
- 38f20773-75da-4e02-8a40-934bf615f82a.filesusr.com
- 7ba6101a-5764-498f-8bc9-9acb8659e08d.filesusr.com
- 81dcb41d-3826-4f4c-981a-d2469a70dee7.filesusr.com
- 07ed169d-f166-451b-86fe-9bac6989c938.filesusr.com
- ffb8412e-6a8a-420e-aeff-9e660079a815.filesusr.com
- 8f86e8ce-ffe8-4fe9-a03f-68bdc88f3698.filesusr.com
- dea7fad3-7bf5-4b56-815a-d0bda601a5bf.filesusr.com
- fc4539c5-90d7-4be8-8cdb-d5748d9d6e9e.filesusr.com
- stportal.mahendras.org
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report