MALICIOUS — 8118384.pdf

MALICIOUS — 8118384.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (70/100), attributed to the SBadur family. 3 of 50 detection engines flagged it.

Identification

• SHA-256: a5abcd0952aec173d67eb2249e5dad4d2e30123959c12e0f2e477e29dc83b942
• SHA-1: 8c5106870ac81c89305d36d55b2c2f07402f0af9
• MD5: fffd2e276f9548e00691f49786f9ba7d
• ssdeep: 1536:kGFteKjWWjONNtimGgKn0LymVCH2/gMn/jCkA:xFtePyOfBSn0mmVO2/gI7CX
• TLSH: T15737BFF35063ED4C7ACF9B47ADAA11686086D7CD2532A79004D8776CD17CABE7E00660
• Submitted as: 8118384.pdf
• File type: pdf · Size: 72730 bytes
• Verdict: malicious (70/100) · Family: SBadur

Detections (3 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 70/100 is the fusion of 4 weighted signals:

• Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85
• Embedded network infrastructure: https://cctraff.ru/wb?keyword=model%20averaging%20in%20r, https://cdn.shopify.com/s/files/1/0501/8334/0192/files/duwapudomiruz.pdf, https://cdn.shopify.com/s/files/1/0481/6145/6279/files/xovorakowego.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cctraff.ru/wb?keyword=model%20averaging%20in%20r
• https://cdn.shopify.com/s/files/1/0501/8334/0192/files/duwapudomiruz.pdf
• https://cdn.shopify.com/s/files/1/0481/6145/6279/files/xovorakowego.pdf
• https://cdn.shopify.com/s/files/1/0484/4122/9470/files/descartes_discourse_on_method_and_meditations_on_first_philosophy.pdf
• https://site-1039344.mozfiles.com/files/1039344/59352547415.pdf
• https://site-1039923.mozfiles.com/files/1039923/pozulex.pdf
• https://site-1037202.mozfiles.com/files/1037202/50038944408.pdf
• https://site-1038694.mozfiles.com/files/1038694/30431674591.pdf
• https://site-1039661.mozfiles.com/files/1039661/71540615287.pdf
• https://site-1039689.mozfiles.com/files/1039689/xepibawewitizo.pdf
• https://site-1042013.mozfiles.com/files/1042013/rulalixa.pdf
• https://site-1037253.mozfiles.com/files/1037253/88378782174.pdf
• https://site-1042539.mozfiles.com/files/1042539/fubudedol.pdf
• https://site-1038880.mozfiles.com/files/1038880/96876162349.pdf
• https://site-1048567.mozfiles.com/files/1048567/30862899906.pdf
• https://site-1043790.mozfiles.com/files/1043790/wiliberaxigubipepugibi.pdf
• https://site-1040567.mozfiles.com/files/1040567/jewuzifuj.pdf
• https://site-1041387.mozfiles.com/files/1041387/guvijuginasowegewexo.pdf
• https://site-1040399.mozfiles.com/files/1040399/2966227070.pdf
• https://lipowuripipu.weebly.com/uploads/1/3/1/3/131378852/1380891.pdf
• https://pigogokeda.weebly.com/uploads/1/3/1/8/131857695/7bf01a8e81.pdf
• https://guwomenod.weebly.com/uploads/1/3/0/8/130873843/domovodibaposix.pdf
• https://site-1036693.mozfiles.com/files/1036693/52547280695.pdf
• https://site-1038872.mozfiles.com/files/1038872/selogisejelisedarux.pdf
• https://site-1037164.mozfiles.com/files/1037164/lakezudatupefodokexib.pdf

Embedded domains

• cctraff.ru
• cdn.shopify.com
• site-1039344.mozfiles.com
• site-1039923.mozfiles.com
• site-1037202.mozfiles.com
• site-1038694.mozfiles.com
• site-1039661.mozfiles.com
• site-1039689.mozfiles.com
• site-1042013.mozfiles.com
• site-1037253.mozfiles.com
• site-1042539.mozfiles.com
• site-1038880.mozfiles.com
• site-1048567.mozfiles.com
• site-1043790.mozfiles.com
• site-1040567.mozfiles.com
• site-1041387.mozfiles.com
• site-1040399.mozfiles.com
• lipowuripipu.weebly.com
• pigogokeda.weebly.com
• guwomenod.weebly.com
• site-1036693.mozfiles.com
• site-1038872.mozfiles.com
• site-1037164.mozfiles.com
• site-1043928.mozfiles.com
• site-1039918.mozfiles.com

More SBadur samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report