MALICIOUS — normal_604d8b71d5dfb.pdf

MALICIOUS — normal_604d8b71d5dfb.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 08b9c50bdc274b089b16a893dbeb199aedc5d8678d1c813361289c9aceef7996
SHA-1: 54c900001270e337a996005d743bf00e430c06da
MD5: 523594c3db3cefcc926fb002bdda9545
ssdeep: 1536:M5XJUAgaS0Az0WKbBHc6ilTVzF0Slt29Y3GQlSdgooUN6a7mtLV3Ne5i6Z:KZUAgp00ubB86cT9GSlP9SdNoUNx7EIt
TLSH: T1FF39BFB71297DE8CB58B9B533DE7362D618AD39871329B801148726CC1BC76E7F00A50
Submitted as: normal_604d8b71d5dfb.pdf
File type: pdf · Size: 87127 bytes
Verdict: malicious (96/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!523594C3DB3C
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Contacted 19 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://cdn-cms.f-static.net/uploads/4381973/normal_603180f88ebaa.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://dafemum.ru/123?utm_term=dog+sheetz+waterproof+dog+bed+cover, https://lobixeximoruse.weebly.com/uploads/1/3/5/3/135319822/noxuwuman_rejukupunajirux_sezis_zigor.pdf, https://cdn.sqhk.co/wetilusogaki/a0jCdje/american_football_house_location.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (11 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9835 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
ntp.ubuntu.com
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\68183567b3368ebbe0267e6a07c16aa8.png - f9e6e21ab1145f3b96cb566b14b4a8168c6e8b348b6c8d072c4bd4176f823313
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - df7e7e2c6ce44b013511a197410631eb13997287025a1d7ae605cad9d14f3c00
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://dafemum.ru/123?utm_term=dog+sheetz+waterproof+dog+bed+cover
https://lobixeximoruse.weebly.com/uploads/1/3/5/3/135319822/noxuwuman_rejukupunajirux_sezis_zigor.pdf
https://cdn.sqhk.co/wetilusogaki/a0jCdje/american_football_house_location.pdf
https://s3.amazonaws.com/lefemijip/agent_orange_deformities_pictures.pdf
https://s3.amazonaws.com/setigafat/diferencia_entre_amnistia_e_indulto.pdf
https://cdn.sqhk.co/sutazojawote/cjMRWUs/fabafetosejixar.pdf
https://cdn.sqhk.co/mubogasaven/ic4jfYm/xufugipilimixijulapapuxu.pdf
https://cdn.sqhk.co/tokofape/bCAifeQ/18951177159.pdf
https://gamevuwi.weebly.com/uploads/1/3/4/5/134525912/4aeeb1028a0.pdf
https://cdn-cms.f-static.net/uploads/4381973/normal_603180f88ebaa.pdf
https://tadilagene.weebly.com/uploads/1/3/1/3/131381422/1790334.pdf
http://gefaveje.22web.org/ives_8400_kick_plate_cut_sheet.pdf
https://cdn.sqhk.co/kasunelebak/EheDDpm/zebetabo.pdf
https://s3.amazonaws.com/kovezodepugov/free_embroidery_designs_library.pdf
https://cdn-cms.f-static.net/uploads/4450898/normal_60177c9be893a.pdf
https://kavikazu.weebly.com/uploads/1/3/5/3/135392310/5843329.pdf
https://s3.amazonaws.com/lejivugeleguwod/holy_tamil_bible_app_free.pdf
http://modurogodolu.epizy.com/59692865956.pdf
https://sidasunepur.weebly.com/uploads/1/3/6/0/136088000/rukoboduwurunuwozetu.pdf
https://cdn.sqhk.co/rubogomuweme/iiMmhgP/pomodiwatutoxinumudokovib.pdf
https://cdn.sqhk.co/nujusowidom/jaROici/infection_rate_of_covid_19_in_texas.pdf
https://s3.amazonaws.com/mubemutolewe/android_tv_os_para_pc.pdf
https://static.s123-cdn-static.com/uploads/4452609/normal_5fe238e968df7.pdf
https://cdn.sqhk.co/sepagumal/h1gdaww/78877447848.pdf
http://tonobipuko.iblogger.org/how_to_record_on_mackie_dl1608.pdf

Embedded domains

dafemum.ru
lobixeximoruse.weebly.com
cdn.sqhk.co
s3.amazonaws.com
gamevuwi.weebly.com
cdn-cms.f-static.net
tadilagene.weebly.com
gefaveje.22web.org
kavikazu.weebly.com
modurogodolu.epizy.com
sidasunepur.weebly.com
static.s123-cdn-static.com
tonobipuko.iblogger.org
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

172.172.255.218
4.150.223.110
52.110.12.48
57.154.63.210
4.230.171.124
4.144.132.223
74.178.76.54
20.76.201.171
40.99.133.226
52.123.129.14
40.104.4.2
172.178.240.161
74.178.76.128
72.154.7.108
203.26.79.13
4.150.223.105
20.50.201.201
4.150.223.108
20.42.65.84

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report