MALICIOUS — nujefemibo.pdf

MALICIOUS — nujefemibo.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (72/100). 2 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 32367677229a4ca5afcfb881e01325e770c554d014cf9f2cd7d291a48b05968a
SHA-1: 426b74e1186f2d142f66b7718590a7f602387228
MD5: be57e1a7207d9799e5fd328b8d5fe7d0
ssdeep: 768:7gGzpDyc7MFoJMuoywTDh873wguEj6PQ/rmQZN0:EGF2c1Jf8Wgq6YrbZN0
TLSH: T10E329DF39097EC8C7B82AB03ADF611549289D78D213693B45489377ED4BC6BDBE10860
Submitted as: nujefemibo.pdf
File type: pdf · Size: 43808 bytes
Verdict: malicious (72/100)

Detections (2 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1

MITRE ATT&CK

Why this verdict

The malicious score of 72/100 is the fusion of 6 weighted signals:

Contacted 27 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/f51b10d5-10a6-4faa-9821-49586e91b087/wimekejemujejigubupeju.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://gettraff.ru/strik?keyword=adverbs+of+manner+lesson+plan+pdf, https://site-1036754.mozfiles.com/files/1036754/worikobuluveselatonurikam.pdf, https://site-1037024.mozfiles.com/files/1037024/25500564209.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9764 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787775469&P2=404&P3=2&P4=blB61Y4NzEy2YRjK4pb9miAbaxXkc%2fCxo5d4QJp5BYU9XgAzX%2bqKXCy6XFgvLd4jSdspdVm9Vr31bWAiuPwuPw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787775508&P2=404&P3=2&P4=EK%2bx2vLVzOJktRckmG1DEhnn3GXtXI8TX3%2bUxUu%2bTSMsgTZDIyFHoy5O%2fY9VE%2fWgj3qvDirryfvz6BQR0WBZZw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 94078c7eee3924845b8304bc1f8658d33dee5e52d3691940aaefcaa73724c177
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\eb8af7f278015ad7ace6ea2af097c79c.png - 45e5fa1976ea16dfb5ec1957000394901d13732bac0b451561bd9a8f81ef9c07
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://gettraff.ru/strik?keyword=adverbs+of+manner+lesson+plan+pdf
https://site-1036754.mozfiles.com/files/1036754/worikobuluveselatonurikam.pdf
https://site-1037024.mozfiles.com/files/1037024/25500564209.pdf
https://site-1036686.mozfiles.com/files/1036686/jabuvafi.pdf
https://site-1037205.mozfiles.com/files/1037205/16724789005.pdf
https://site-1036702.mozfiles.com/files/1036702/83043078124.pdf
https://site-1036807.mozfiles.com/files/1036807/29196059069.pdf
https://site-1037235.mozfiles.com/files/1037235/lidibupezidogawuzokim.pdf
https://site-1036733.mozfiles.com/files/1036733/nalupekafamozu.pdf
https://uploads.strikinglycdn.com/files/f51b10d5-10a6-4faa-9821-49586e91b087/wimekejemujejigubupeju.pdf
https://uploads.strikinglycdn.com/files/a1732abe-f9c5-46f8-b52d-54bafd00e642/nebitate.pdf
https://uploads.strikinglycdn.com/files/0c916e7e-e6f6-4b78-b63d-cc1d7d7e0078/sifevax.pdf
https://uploads.strikinglycdn.com/files/30db726c-54f9-4abf-aeb2-c9b52e166063/87835811421.pdf
https://uploads.strikinglycdn.com/files/60c955f9-f668-409e-80d5-f798cf4dbf5f/danegodozav.pdf
https://uploads.strikinglycdn.com/files/808ce401-ad0b-46ab-bb16-f75d6ba0ec39/jivunax.pdf
https://uploads.strikinglycdn.com/files/4c55012b-03d8-4a79-af50-9e4d8c1dd5a2/96615552599.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

gettraff.ru
site-1036754.mozfiles.com
site-1037024.mozfiles.com
site-1036686.mozfiles.com
site-1037205.mozfiles.com
site-1036702.mozfiles.com
site-1036807.mozfiles.com
site-1037235.mozfiles.com
site-1036733.mozfiles.com
uploads.strikinglycdn.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

74.178.232.29
52.110.12.33
4.230.171.124
72.145.35.99
203.26.79.13
135.233.95.144
13.89.179.12
52.123.129.14
40.99.133.242
52.123.252.212
135.233.45.222
13.69.109.130
142.250.195.227
4.209.250.170
20.184.175.2
52.182.143.212
20.42.179.204
48.192.143.121
4.150.223.96
4.247.188.233
40.84.85.40
20.42.65.88
85.210.196.11
57.155.101.212
172.172.255.218

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report