MALICIOUS — normal_5fe89da50a8e3.pdf

MALICIOUS — normal_5fe89da50a8e3.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 50 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: 2553164660696ed99e0c31065cb9df898de2a9c8839efd539a230a2ce3e091bc
• SHA-1: 3e65dfa7a496cb4f507065a09a2b4ea003cb1314
• MD5: e8c7a9e9b0bcef6b2cb4119471c3ee2f
• ssdeep: 1536:yGk6TzYna8KGblY0ChjYP7IpNJpvF7I/heCJXE42Hz0:JvYnV40kBpNDZ6eCFV2Y
• TLSH: T13637CFF3A293DD8C6A46AF43B5E9641CA44AD78D3472DA95848C367CC0BC66C7F14E10
• Submitted as: normal_5fe89da50a8e3.pdf
• File type: pdf · Size: 73889 bytes
• Verdict: malicious (98/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1112
• T1105
• T1566.002

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated malicious by URL analysis: https://uploads.strikinglycdn.com/files/2aa41b05-0d59-47ae-b06f-9c5810bdaab5/49675109518.pdf - network signal, weight 0.70, confidence 0.80
• Contacted 17 external host(s) at runtime (7 HTTP) - network signal, weight 0.40, confidence 0.80
• Embedded network infrastructure: https://trafffi.ru/123?utm_term=kirby+heritage+ii+review, https://lulitetuxopibol.weebly.com/uploads/1/3/1/1/131164377/e30c0271c0.pdf, https://tejemovifizak.weebly.com/uploads/1/3/2/6/132681066/xasoloromofinu_dalideditaw_tosomojeviju_mujilopasig.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Extracted generic config (6 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9607 behavior events · 1 ATT&CK techniques · 3 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• searchapp.bundleassets.example
• outlook.office365.com
• outlook.cloud.microsoft
• desktop-hsgcbep._dosvc._tcp.local
• desktop-hsgcbep
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 250.255.255.239.in-addr.arpa
• ntp.ubuntu.com
• desktop-hsgcbep(1)._dosvc._tcp.local

Dropped files

• C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 0d0a8a669d819a633db9d8dc38da08e4cbbec87947da26ab75247529ef8a8f20
• C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\e9cc8a6ffe0e8b11750d9258309753f5.png - 75f655407956656195c162b7dc443212b7675a4570700b2fda7d2d149dff9a87
• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://trafffi.ru/123?utm_term=kirby+heritage+ii+review
• https://lulitetuxopibol.weebly.com/uploads/1/3/1/1/131164377/e30c0271c0.pdf
• https://s3.amazonaws.com/tazopaju/ladies_platform_brogue_shoes.pdf
• https://s3.amazonaws.com/dakebesuvum/20093611076.pdf
• https://tejemovifizak.weebly.com/uploads/1/3/2/6/132681066/xasoloromofinu_dalideditaw_tosomojeviju_mujilopasig.pdf
• https://s3.amazonaws.com/selivuvumepaveb/go_launcher_super_vip_apk_cracked.pdf
• https://s3.amazonaws.com/rudelazifizuvo/index._html_template_free.pdf
• https://morurotefat.weebly.com/uploads/1/3/4/3/134317018/gugaloduwo.pdf
• https://s3.amazonaws.com/wekibik/dt830b_digital_multimeter_manual.pdf
• https://uploads.strikinglycdn.com/files/ed8740cd-61d0-4673-b705-5c32f69fc576/bhagavad_gita_as_it_is_in_marathi.pdf
• https://s3.amazonaws.com/kuxuxemu/ferosha_kotla_stadium_pitch_report.pdf
• https://uploads.strikinglycdn.com/files/2aa41b05-0d59-47ae-b06f-9c5810bdaab5/49675109518.pdf
• https://s3.amazonaws.com/ravuxudibure/sigalusujedazonoka.pdf
• https://s3.amazonaws.com/bejeseja/mozeruwekok.pdf
• https://s3.amazonaws.com/xunilukegez/hormonal_therapy_breast_cancer_guidelines.pdf
• https://s3.amazonaws.com/jafujasiwetid/spelling_checker_software_free_for_pc.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• trafffi.ru
• lulitetuxopibol.weebly.com
• s3.amazonaws.com
• tejemovifizak.weebly.com
• morurotefat.weebly.com
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com

Embedded IP addresses

• 135.233.95.144
• 4.150.223.102
• 57.155.104.224
• 52.110.12.11
• 4.230.171.124
• 52.123.252.203
• 72.154.7.106
• 203.26.79.13
• 20.112.250.133
• 135.233.95.135
• 52.123.128.14
• 74.178.76.128
• 20.165.94.63
• 52.123.252.202
• 4.209.250.170
• 4.150.223.110
• 162.159.36.2

File paths

• i:\61

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report