MALICIOUS — 90790306266.pdf

MALICIOUS — 90790306266.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (72/100). 2 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 327fc3db0750de3b1c25bb5b5f85bbb4a6304ea920c715af807459278e89b470
SHA-1: 201f96e459a4f559e2f47e8cb3bb2b604eb0046d
MD5: 36d255b91c1608ff22f87250e6a9f4e9
ssdeep: 1536:mGFNd6oq3SuaRVUy7ZhiwBbT+1l9OA+tvIfh6KFnVHSAAYcZDaLR79G8fmg:/FN83S1/UyvDBbp2J6KFoAALVaF79G8F
TLSH: T1A13AD0F34457ED4C7ABBDF13A963089A7145EA98A2318A5052A83F3CC47CE7C6F41624
Submitted as: 90790306266.pdf
File type: pdf · Size: 97453 bytes
Verdict: malicious (72/100)

Detections (2 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1

MITRE ATT&CK

Why this verdict

The malicious score of 72/100 is the fusion of 6 weighted signals:

Contacted 18 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://files.hightstownhsbands.org/uploads/1/3/2/3/132303151/poluna-kedowoda-pajidil-nuvodubepu.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://gettraff.ru/strik?keyword=reporter+amharic+news+pdf, https://cdn.shopify.com/s/files/1/0430/1013/0073/files/dulokanizobakubesipizobu.pdf, https://cdn.shopify.com/s/files/1/0431/1361/1413/files/blank_multiplication_chart.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (11 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9644 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
desktop-hsgcbep
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787773733&P2=404&P3=2&P4=jMn2CWcHb6ddjE%2bMnftvFoGr8VwJmLM3GrUBqc1HVzWRyRHRvl4YIbVYmYUoahgXJpCHrMDnAie%2fzM9masOHYg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787773785&P2=404&P3=2&P4=LpxCty1TuaPj1jH3bUmxSgCcaAimOLaUho30nHXiA8v5pVosF05G2LJtz4m4Io%2fGQwEj%2fbzBGhmDxd6yg6Q%2fLw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
23.40.52.209

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 00b2c9dd5582cdf2ad8489e88d50d67f43722f02f5d26d26acc088666d16cd13
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\63a70c87ceb9ff61f7cd282315283b94.png - b2fa931cc347d1c2424f909022affc16735c70c5f9ea2148e8aa02fe63acd628
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://gettraff.ru/strik?keyword=reporter+amharic+news+pdf
https://cdn.shopify.com/s/files/1/0430/1013/0073/files/dulokanizobakubesipizobu.pdf
https://cdn.shopify.com/s/files/1/0431/1361/1413/files/blank_multiplication_chart.pdf
https://cdn.shopify.com/s/files/1/0428/6464/0159/files/zewelarituva.pdf
https://site-1037091.mozfiles.com/files/1037091/gokisidezenefoxuwenip.pdf
https://site-1036637.mozfiles.com/files/1036637/93515956903.pdf
https://site-1036791.mozfiles.com/files/1036791/lakikixigiganikarekusavij.pdf
http://files.thewooliers.com/uploads/1/3/1/4/131406744/rakowoj.pdf
http://kodafoful.elportalschoolptg.com/uploads/1/3/1/6/131606666/3302135.pdf
http://files.hightstownhsbands.org/uploads/1/3/2/3/132303151/poluna-kedowoda-pajidil-nuvodubepu.pdf
http://files.tumaytunur.com/uploads/1/3/0/7/130775808/3614736.pdf
http://files.kountrykupboards.com/uploads/1/3/0/7/130740371/gevifeniguxojin_gugidomuvajof_ruzemud_vowupopa.pdf
http://files.tenderyearschildcarellc.com/uploads/1/3/1/0/131070982/jonixefimur.pdf
http://files.nickhiggs.com/uploads/1/3/2/6/132695832/92d90.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787773733&P2=404&P3=2&P4=jMn2CWcHb6ddjE%2bMnftvFoGr8VwJmLM3GrUBqc1HVzWRyRHRvl4YIbVYmYUoahgXJpCHrMDnAie%2fzM9masOHYg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

gettraff.ru
cdn.shopify.com
site-1037091.mozfiles.com
site-1036637.mozfiles.com
site-1036791.mozfiles.com
files.thewooliers.com
kodafoful.elportalschoolptg.com
files.hightstownhsbands.org
files.tumaytunur.com
files.kountrykupboards.com
files.tenderyearschildcarellc.com
files.nickhiggs.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

4.150.223.112
52.123.252.244
52.110.12.54
52.110.12.40
4.247.188.224
4.230.171.124
57.155.101.212
74.179.77.204
4.207.44.76
40.99.134.18
20.50.201.205
52.123.128.14
172.178.240.161
135.233.95.80
72.154.7.102
203.26.79.13
85.210.196.11
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report