MALICIOUS — normal_5fd98e558f4f3.pdf

MALICIOUS — normal_5fd98e558f4f3.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 2024eda7464296efb89209a767e21d921e21175e1750c828c98ad390ec96298c
SHA-1: cda50dfdc7648a2e0e8902a0b69729e968483a0c
MD5: 0aa4fef36b174502493fa3c70c61a17b
ssdeep: 1536:AXPvg5wO7D7S6NBTF5VymqiNeHLUIea0ZOk:0g+E7pTFCmqSeHYrr/
TLSH: T10637E0F36187DE4E6A431F533AF71958B04ED348B912A96445C87A1C88BC1BD7F20EA1
Submitted as: normal_5fd98e558f4f3.pdf
File type: pdf · Size: 75296 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4369191/normal_5fc7d67010632.pdf - network signal, weight 0.70, confidence 0.80
Contacted 19 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://traffnew.ru/123?utm_term=cissp+common+body+of+knowledge+%2528cbk%2529+8+domains, https://static.s123-cdn-static.com/uploads/4369191/normal_5fc7d67010632.pdf, https://cdn-cms.f-static.net/uploads/4385613/normal_5fa23badc8f16.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (7 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9743 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
desktop-hsgcbep
ntp.ubuntu.com
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\698f2791860368298abddfe11bd7894d.png - 73906e4a6ae809424311c3fc59721c7ed30669e907da3d5cacc41c0fbe4bb051
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - abf9c605148a04906f4503ffa82782eae7f56f03e1c2522f4d8c022809b19a52
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://traffnew.ru/123?utm_term=cissp+common+body+of+knowledge+%2528cbk%2529+8+domains
https://static.s123-cdn-static.com/uploads/4369191/normal_5fc7d67010632.pdf
https://cdn-cms.f-static.net/uploads/4385613/normal_5fa23badc8f16.pdf
https://s3.amazonaws.com/jezobasit/informacion_del_aguila_arpia_en_ingles.pdf
https://jobalexaxikut.weebly.com/uploads/1/3/4/8/134892204/3799317.pdf
https://s3.amazonaws.com/bisazabe/42568075981.pdf
https://xoxatazafej.weebly.com/uploads/1/3/4/8/134861408/9083570.pdf
https://cdn-cms.f-static.net/uploads/4365627/normal_5f8700559ea23.pdf
https://s3.amazonaws.com/wilugugo/simic_hybrid_5e.pdf
https://cdn-cms.f-static.net/uploads/4370078/normal_5f900134d170c.pdf
https://uploads.strikinglycdn.com/files/4bc14d97-1dfb-4f86-8a87-5e91661104db/undertale_music_download.pdf
https://static.s123-cdn-static.com/uploads/4416790/normal_5fc7ea11cf6a5.pdf
https://s3.amazonaws.com/dosalapasenow/cara_membuat_template_email_di_outlook.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787759279&P2=404&P3=2&P4=ElaeQRDsIXdJfIPPAcqWV6m8dmxOQLttvpHBIrNRZZj489UYIPwaPfQQNi7EJmKwncrgijmV5XffjjMNrmGzPA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

traffnew.ru
static.s123-cdn-static.com
cdn-cms.f-static.net
s3.amazonaws.com
jobalexaxikut.weebly.com
xoxatazafej.weebly.com
uploads.strikinglycdn.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

172.66.2.5
52.110.12.31
4.155.95.248
4.230.171.124
135.233.95.80
72.154.7.101
203.26.79.13
20.42.65.93
20.76.201.171
135.233.95.144
52.123.128.14
57.154.63.210
142.251.42.99
172.178.240.161
172.170.180.133
20.184.175.12
52.123.129.14
172.172.255.216
142.251.222.227

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report