MALICIOUS — dodakajik.pdf

MALICIOUS — dodakajik.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (72/100). 2 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 287a222ef39169857d9932a66eb1f03bf15c739c29116817c9e0c45072d7b080
SHA-1: 679f442e5f061b935a51938b81bf01480ad8b3ff
MD5: 6fe0b15233f1c5a67076a9422af4c155
ssdeep: 1536:9GFgJEjFWygg375a02wi1JcrVOw6pOzBq3g0lPkjAd:AFgJEsutxwJ2lBzxa
TLSH: T12A34AFF3409BED8C7986AB036EAB10592146C64D7273ABA044DD777CC47C2BCBE54A60
Submitted as: dodakajik.pdf
File type: pdf · Size: 54298 bytes
Verdict: malicious (72/100)

Detections (2 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1

MITRE ATT&CK

Why this verdict

The malicious score of 72/100 is the fusion of 6 weighted signals:

Contacted 22 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/84480615-b7fb-4b96-a963-64eede17b1c9/nujefemibo.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://cctraff.ru/strik?keyword=lincoln+movie+study+guide+answer+key, https://cdn.shopify.com/s/files/1/0435/8642/0893/files/40515646675.pdf, https://cdn.shopify.com/s/files/1/0431/9599/0175/files/44402214133.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (8 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9713 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787774873&P2=404&P3=2&P4=OgoroRbFbuvCkSmGYWe4UhbCMh9%2bd9PI9GN84pQf6nGGWBByT15OfCFB%2b9YfXqMYcTzW3jng8be2ZGuIibnKAg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787774971&P2=404&P3=2&P4=Y4UlXURYB1ubJTQDKjI9lt7nnZVN1M4G5uaATxwZOaoCtR1UAJNmOXiCeRlwVaQrP8PKjqmKp9eKerAzz8X0Iw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\a5088bb9c1dc53ec98907b2e5565d0ae.png - 7a47f72d2c721aa8ab28f912c4e0f5633a11462a16e0f7b2c47e2e2ba781ff18
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 0abec40069c70a0cde5a207fbf1862899c90d48162358da24482f160fe9d7d39
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://cctraff.ru/strik?keyword=lincoln+movie+study+guide+answer+key
https://cdn.shopify.com/s/files/1/0435/8642/0893/files/40515646675.pdf
https://cdn.shopify.com/s/files/1/0431/9599/0175/files/44402214133.pdf
https://cdn.shopify.com/s/files/1/0483/9391/2480/files/chauvenets_criterion_table.pdf
https://cdn.shopify.com/s/files/1/0437/2309/6216/files/mofopebifoxarazopujuzila.pdf
https://cdn.shopify.com/s/files/1/0435/9297/4499/files/skyrim_uthgerd_the_unbroken_hostile.pdf
https://cdn.shopify.com/s/files/1/0483/4449/8336/files/siberian_husky_puppies_for_sale_in_columbus_ohio.pdf
https://site-1040238.mozfiles.com/files/1040238/27291086268.pdf
https://site-1043297.mozfiles.com/files/1043297/10636862333.pdf
https://site-1036659.mozfiles.com/files/1036659/jufutakefopoxujoj.pdf
https://uploads.strikinglycdn.com/files/84480615-b7fb-4b96-a963-64eede17b1c9/nujefemibo.pdf
https://uploads.strikinglycdn.com/files/13120eaf-9fc3-4bc3-9ed0-9e7327ccb34f/sufafarotatoro.pdf
https://uploads.strikinglycdn.com/files/eeadad09-7d07-4f6e-9059-7bd2df7bb144/84509356493.pdf
https://uploads.strikinglycdn.com/files/ec7148db-7071-4aad-a9dc-1bd61138a507/20732124514.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787774873&P2=404&P3=2&P4=OgoroRbFbuvCkSmGYWe4UhbCMh9%2bd9PI9GN84pQf6nGGWBByT15OfCFB%2b9YfXqMYcTzW3jng8be2ZGuIibnKAg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

cctraff.ru
cdn.shopify.com
site-1040238.mozfiles.com
site-1043297.mozfiles.com
site-1036659.mozfiles.com
uploads.strikinglycdn.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

172.66.2.5
52.123.252.248
4.144.132.114
4.230.171.124
57.155.104.224
135.233.95.144
74.178.76.54
20.231.239.246
52.123.128.14
40.99.134.18
203.26.79.13
20.165.94.63
4.150.223.102
135.232.92.34
142.250.207.3
20.184.175.2
20.184.175.12
20.42.73.24
52.148.114.188
74.178.232.29
142.250.195.227
48.199.12.1

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report