MALICIOUS — a18601_d18fe1c42cd142fc8a0aaa216571dd45.pdf

MALICIOUS — a18601_d18fe1c42cd142fc8a0aaa216571dd45.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (82/100). 2 of 54 detection engines flagged it.

Identification

• SHA-256: d1b151f6d306324b90265a22f9b9ea4c8852f25770df16e35f8257dcb60b3dab
• SHA-1: 895787d888759672e9564f9ec05106812aa74788
• MD5: 9d72624276fae2511906bea871bc3f24
• ssdeep: 768:igGzpD0vipfHVFVPJtjkrx51fEZB1yghCZkyM6x2KV:/GFoaTzjkxEZ7zQtM6x2KV
• TLSH: T12C2F6DF350A7EC8C6686EB03ADEA200C954AE7886133A774459C776CD4BC2BD7E11960
• Submitted as: a18601_d18fe1c42cd142fc8a0aaa216571dd45.pdf
• File type: pdf · Size: 33102 bytes
• Verdict: malicious (82/100)

Detections (2 of 54 engines)

• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen

Why this verdict

The malicious score of 82/100 is the fusion of 4 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85
• Embedded network infrastructure: https://ttraff.com/wix?keyword=manual+sansa+clip, http://files.jonathanbrooks.net/uploads/1/3/0/7/130739916/dibapupebi.pdf, http://files.cosmicsquirrelceramix.com/uploads/1/3/1/1/131164386/gakuwa-wugaterajem-zolipetatujo-xesexagisusax.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=manual+sansa+clip
• http://files.jonathanbrooks.net/uploads/1/3/0/7/130739916/dibapupebi.pdf
• http://files.cosmicsquirrelceramix.com/uploads/1/3/1/1/131164386/gakuwa-wugaterajem-zolipetatujo-xesexagisusax.pdf
• http://files.newkitchensplus.net/uploads/1/3/1/4/131453144/7112733.pdf
• http://baduv.bluebirdvignettes.com/uploads/1/3/2/7/132740412/075bc8ed1a774c3.pdf
• http://jazonurol.makeityoursbyalex.com/uploads/1/3/1/4/131483083/3935576.pdf
• https://9fc0ee08-7aad-4d36-b06a-7802bc747c9f.filesusr.com/ugd/ce0e6d_bbfe601dc16348ed952ee70cb2d41c1f.pdf?index=true
• https://989841f5-4df5-4d3d-8654-0d587b4cb72e.filesusr.com/ugd/370ea2_42faffbf218746cbacd4744aa9582b02.pdf?index=true
• https://eb2a098c-8d3b-4ac5-ada1-1923ac1d4cb1.filesusr.com/ugd/b463f2_4ca5b067b49c42d081b40234547705c8.pdf?index=true
• https://000a6025-0e46-4e46-ae06-90f6bc569276.filesusr.com/ugd/b14caa_5638a8bf7eff48e4871775dc3d3a37b0.pdf?index=true
• https://cdn.shopify.com/s/files/1/0479/1006/0196/files/cookie_clicker_unblocked_games_66_ez.pdf
• https://cdn.shopify.com/s/files/1/0431/4854/2109/files/tetexegulalibami.pdf
• https://cdn.shopify.com/s/files/1/0431/6659/7288/files/9947217918.pdf
• https://cdn.shopify.com/s/files/1/0470/6913/5016/files/carmina_burana_partition_piano.pdf
• https://cdn.shopify.com/s/files/1/0430/6475/4325/files/channel_2_news_reporters_houston.pdf
• https://cdn.shopify.com/s/files/1/0433/6100/9829/files/nilovisesewi.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• files.jonathanbrooks.net
• files.cosmicsquirrelceramix.com
• files.newkitchensplus.net
• baduv.bluebirdvignettes.com
• jazonurol.makeityoursbyalex.com
• 9fc0ee08-7aad-4d36-b06a-7802bc747c9f.filesusr.com
• 989841f5-4df5-4d3d-8654-0d587b4cb72e.filesusr.com
• eb2a098c-8d3b-4ac5-ada1-1923ac1d4cb1.filesusr.com
• 000a6025-0e46-4e46-ae06-90f6bc569276.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report