MALICIOUS — normal_5fae27fcd58fe.pdf

MALICIOUS — normal_5fae27fcd58fe.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 0b8bd7310822ba5bb603719f7644cf22854a97ca66c39bf3407fbe6c9f7099a0
SHA-1: cf906d91785c62bfc4df7a5b6fdd35a8be9c820b
MD5: 3125ba88696291e7bfb14f8eac34d2fd
ssdeep: 1536:dsLwHota3mHPDpPdQ26CexUVwuei2V9iltKwmqD1FgB03I:NHoYGDZm26CqUeueiC9iltKwmqjef
TLSH: T11837E0F37297DD4C7A4AA74739BB189C686DD24CB532976150883ABCC63857CFE10A20
Submitted as: normal_5fae27fcd58fe.pdf
File type: pdf · Size: 74630 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 20 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/f4647a4c-8c67-4be2-a2ef-136b80336442/kodesuzunemovumunogaja.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://traffking.ru/123?utm_term=the+ultimate+guide+to+price+action+trading+by+mangi+madang, https://cdn-cms.f-static.net/uploads/4447280/normal_5f9d50c6dff15.pdf, https://uploads.strikinglycdn.com/files/f4647a4c-8c67-4be2-a2ef-136b80336442/kodesuzunemovumunogaja.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (6 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9769 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
ntp.ubuntu.com
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\1ed1521bbb69836b0f4a917e9127eeff.png - bb16a596f05d226364065b7960db5a4a395e173307f75eb996c9c4ac139831e7
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 5aaa8b46ed7a565a27a4a6a6b1835bed87f51f4f9ba15e5d4738fbe1e07072c6
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://traffking.ru/123?utm_term=the+ultimate+guide+to+price+action+trading+by+mangi+madang
https://s3.amazonaws.com/wonoti/maths_books_in_hindi_free_download.pdf
https://cdn-cms.f-static.net/uploads/4447280/normal_5f9d50c6dff15.pdf
https://uploads.strikinglycdn.com/files/f4647a4c-8c67-4be2-a2ef-136b80336442/kodesuzunemovumunogaja.pdf
https://cdn-cms.f-static.net/uploads/4369914/normal_5f89ef424ffc8.pdf
https://s3.amazonaws.com/veraxawewib/break_even_analysis_excel_template_free.pdf
https://memupenenukef.weebly.com/uploads/1/3/4/5/134527104/c2b9cb49cca.pdf
https://cdn-cms.f-static.net/uploads/4411246/normal_5fa74a91c6c71.pdf
https://s3.amazonaws.com/vitelitubovuluj/slope_game_online.pdf
https://cdn-cms.f-static.net/uploads/4371809/normal_5fa4ab065ebf8.pdf
https://s3.amazonaws.com/paropabaru/bicarbonato_de_sodio_formula.pdf
https://livekurot.weebly.com/uploads/1/3/4/4/134443702/latugabujub-pogezonezonapa.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787742251&P2=404&P3=2&P4=mfbO7hB%2bscMiyEDqEM8jIm3hziXmywuvmtcT8JdtbYgDi4d%2btnlc7jhwKVnzYo%2bKJvBz2pIIO%2bi3AcDqThcMZg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787742305&P2=404&P3=2&P4=Ro6AmPgQiV3dWqaPeTDKtaPGgouT7el4Zigpy%2b%2fsKWYCfNFkHFQjwfCWPhoQLQb8BHE838%2feahO%2fFmSimJP53A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

traffking.ru
s3.amazonaws.com
cdn-cms.f-static.net
uploads.strikinglycdn.com
memupenenukef.weebly.com
livekurot.weebly.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

172.172.255.217
52.168.117.174
4.247.188.233
52.110.12.55
4.230.171.124
20.247.185.124
74.179.77.204
4.150.223.114
20.112.250.133
40.99.134.18
52.123.129.14
52.123.252.222
40.99.133.226
72.153.5.128
203.26.79.13
57.155.104.224
48.199.12.1
51.105.71.137
20.184.175.11
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report