MALICIOUS — zamiv_tixomutudorasuv.pdf

MALICIOUS — zamiv_tixomutudorasuv.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (70/100), attributed to the SBadur family. 3 of 50 detection engines flagged it.

Identification

SHA-256: a0ff6a4c1b72f8af19dc205dbde75119b714bfc5aedd733ab58a168fbd6a377f
SHA-1: ccf5177cb676370bf2fc3c7753bc2a63b4d9f961
MD5: a42d839bb34313533d2d0555afab27bf
ssdeep: 768:d+gGzpDtpmAhkasZKQ+ZE3+j6cBAT2Oyb5hTU5140LCpRqwJNhyRKFuRUw31sv9P:1GFBpFFhDTU51f+6wxyR+w31sv9P
TLSH: T1C0328DF364ABDD8CBA839B936DBB11A52489C388722797504488376CD5BC6BD7F10860
Submitted as: zamiv_tixomutudorasuv.pdf
File type: pdf · Size: 43509 bytes
Verdict: malicious (70/100) · Family: SBadur

Detections (3 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 70/100 is the fusion of 4 weighted signals:

Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85
Embedded network infrastructure: https://cctraff.ru/wb?keyword=dimensiones%20de%20una%20cancha%20de%20basquetbol, https://uploads.strikinglycdn.com/files/14e41352-799b-4dbd-967f-3fac6eaf0131/borafoje.pdf, https://uploads.strikinglycdn.com/files/bd665e78-3ee2-44e5-9499-d7d1b5252ac8/mibenefujon.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://cctraff.ru/wb?keyword=dimensiones%20de%20una%20cancha%20de%20basquetbol
https://uploads.strikinglycdn.com/files/14e41352-799b-4dbd-967f-3fac6eaf0131/borafoje.pdf
https://uploads.strikinglycdn.com/files/bd665e78-3ee2-44e5-9499-d7d1b5252ac8/mibenefujon.pdf
https://uploads.strikinglycdn.com/files/9204913b-d910-4da1-ad77-7f563e59641d/que_es_una_topologa_de_red.pdf
https://cdn-cms.f-static.net/uploads/4366313/normal_5f8b9d4013619.pdf
https://cdn-cms.f-static.net/uploads/4375086/normal_5f8e6e0108ceb.pdf
https://cdn-cms.f-static.net/uploads/4366312/normal_5f8a06ee0fc8b.pdf
https://cdn-cms.f-static.net/uploads/4382423/normal_5f8c3eaaf2167.pdf
https://cdn-cms.f-static.net/uploads/4381541/normal_5f8c5f91ab809.pdf
https://cdn-cms.f-static.net/uploads/4366036/normal_5f8c88a820ab0.pdf
https://cdn-cms.f-static.net/uploads/4369920/normal_5f8c848d3b949.pdf
https://cdn-cms.f-static.net/uploads/4369760/normal_5f89cacb27ffc.pdf
https://uploads.strikinglycdn.com/files/1c464f0d-9696-4a83-bef8-4a3116363d31/70866656307.pdf
https://uploads.strikinglycdn.com/files/bdffd02f-cbf7-4463-9456-73e108b457ed/67268209935.pdf
https://uploads.strikinglycdn.com/files/595ae8e3-a601-48e5-b246-b415cd0862f7/breath_of_the_wild_cucco_quest.pdf
https://cdn-cms.f-static.net/uploads/4371014/normal_5f8d7165b524b.pdf
https://cdn-cms.f-static.net/uploads/4366987/normal_5f87cd23b519c.pdf
https://cdn-cms.f-static.net/uploads/4373753/normal_5f8dd59907870.pdf
https://cdn-cms.f-static.net/uploads/4373304/normal_5f8a50a862cf1.pdf
https://nutolifawivu.weebly.com/uploads/1/3/1/4/131437776/nusukepijet.pdf
https://mumixopid.weebly.com/uploads/1/3/1/8/131872042/2849321.pdf
https://vodipewelo.weebly.com/uploads/1/3/1/6/131637384/giwalijewawe.pdf
https://fisotewefupug.weebly.com/uploads/1/3/1/0/131071176/87d295001440.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/

Embedded domains

cctraff.ru
uploads.strikinglycdn.com
cdn-cms.f-static.net
nutolifawivu.weebly.com
mumixopid.weebly.com
vodipewelo.weebly.com
fisotewefupug.weebly.com
www.w3.org
purl.org
ns.adobe.com

More SBadur samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report