MALICIOUS — normal_5f89bb5d53480.pdf

MALICIOUS — normal_5f89bb5d53480.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (72/100). 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 304102d4c894b1d05d777cd2c89a3a2a03906f90a11836990af18df36bf6d15b
SHA-1: 4b07194f568af751a7813dbb3ffe4a3fb77114f5
MD5: 037633aeaef0c616eae21fdf264688da
ssdeep: 1536:0GF+eg3yuhoUMyTEefU75VBIQPQ9KUolSI5:BF+egiu64VslV+QPQ9KUqT
TLSH: T13D34AEF71157DD4C76CBEF1369EA245E608AEB496532CB609488372CC5BC3BC2E50960
Submitted as: normal_5f89bb5d53480.pdf
File type: pdf · Size: 54157 bytes
Verdict: malicious (72/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 72/100 is the fusion of 6 weighted signals:

Contacted 20 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/aaf1c9cc-60e3-4f04-a2d9-5b1aaa68273c/84736511838.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://ttraff.me/123?keyword=arch+bridge+popsicle+sticks+instructions, https://cdn.shopify.com/s/files/1/0470/6140/1768/files/86578999477.pdf, https://cdn.shopify.com/s/files/1/0504/1261/7926/files/bob_stone_successful_direct_marketing_methods.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (7 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9631 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
desktop-hsgcbep._dosvc._tcp.local
desktop-hsgcbep(1)._dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787777087&P2=404&P3=2&P4=ThRpZ3nPvkIZzxfaoKrghmoV2we6Celtr4iNbDxs3UA%2b0cjMlLF0PX5nH%2bgBnb7IwpMjJUgAukWDGLZ3RvIQ7A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787777174&P2=404&P3=2&P4=kf4TRqla30QN6u9Uc6UZVV0yvv1tAkeVK%2bzO8Lr4MGPeZqSha%2bbCl5PkcP10rfV0yjrsSSyDQU6Se5h4NgED2g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - cc5aaeb9f23ba4e42507e81ee9fb40520bee179654d539aaa83defe40bc53822
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\b9bdbf8a09138b071cf838417454b8ab.png - 15fde46323f4d59c47c7874ed07b80aa1df034da225a2a8ea52e7f9025e33411
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://ttraff.me/123?keyword=arch+bridge+popsicle+sticks+instructions
https://cdn.shopify.com/s/files/1/0470/6140/1768/files/86578999477.pdf
https://cdn.shopify.com/s/files/1/0504/1261/7926/files/bob_stone_successful_direct_marketing_methods.pdf
https://cdn.shopify.com/s/files/1/0437/1765/6731/files/missouri_class_e_license_manual.pdf
https://cdn-cms.f-static.net/uploads/4366369/normal_5f871c6041b1c.pdf
https://cdn-cms.f-static.net/uploads/4366627/normal_5f87849ab3fb7.pdf
https://cdn-cms.f-static.net/uploads/4369903/normal_5f884ac00ce53.pdf
https://cdn.shopify.com/s/files/1/0486/3157/8782/files/what_is_a_dd214.pdf
https://cdn.shopify.com/s/files/1/0433/5704/4890/files/rizekazirudixuvidebexo.pdf
https://cdn.shopify.com/s/files/1/0431/1898/5377/files/gototubolagilozom.pdf
https://cdn.shopify.com/s/files/1/0479/3722/4860/files/64814539120.pdf
https://cdn.shopify.com/s/files/1/0430/7304/4642/files/best_buy_bluetooth_headphones_sale.pdf
https://cdn.shopify.com/s/files/1/0486/4324/4190/files/30938854457.pdf
https://cdn.shopify.com/s/files/1/0435/2504/6423/files/geometry_regents_august_2017_answers_explained.pdf
https://fuvipizewovotat.weebly.com/uploads/1/3/1/0/131069886/cb1ad389bb24.pdf
https://zeteparikimifol.weebly.com/uploads/1/3/1/6/131637109/raxewobe.pdf
https://nudojafobedem.weebly.com/uploads/1/3/1/3/131379550/lomupivujid.pdf
https://uploads.strikinglycdn.com/files/aaf1c9cc-60e3-4f04-a2d9-5b1aaa68273c/84736511838.pdf
https://uploads.strikinglycdn.com/files/9eb42c7b-9b30-4904-bdb1-43e1453323a2/zufogamanutujur.pdf
https://uploads.strikinglycdn.com/files/f0226979-3336-451e-b380-4c1dc755e654/bubikevawobuzotag.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/

Embedded domains

ttraff.me
cdn.shopify.com
cdn-cms.f-static.net
fuvipizewovotat.weebly.com
zeteparikimifol.weebly.com
nudojafobedem.weebly.com
uploads.strikinglycdn.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

20.42.179.204
4.247.188.233
172.215.188.225
4.150.223.103
52.123.252.194
20.247.184.142
162.159.142.9
4.230.171.124
74.179.71.159
203.26.79.13
74.179.77.204
20.42.65.88
20.76.201.171
40.103.64.226
40.99.133.226
20.42.179.192
172.178.240.162
20.184.175.22
52.123.252.227
92.223.78.30

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report