MALICIOUS — tigefi.pdf

MALICIOUS — tigefi.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (72/100). 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 3f6c4b3462e294c6c3de851eae2410501811d454145a65a1eaa9d0cf2a80c712
SHA-1: 588c491ec30355e11a4322185e7b4d24da781951
MD5: 33073baea68c2ae0356d6759a31c91e8
ssdeep: 768:DgGzpDE4Drjc9/Eo6Kqt8pKnVvLPk710uuD2Uvf6qSOLyg1Y2rB8N26H0+T:8GFw4DMjm810RD2UKqxNmKKz0+T
TLSH: T17732AFF35093DC4C698B9F0758DA146A9685D6887137E260098D7B2DC0BC6FDBF20A60
Submitted as: tigefi.pdf
File type: pdf · Size: 46530 bytes
Verdict: malicious (72/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 72/100 is the fusion of 6 weighted signals:

Contacted 18 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/62e1bee1-3785-4b9f-add3-ea132fe8fcdd/gixiwamijupemugitorawavaj.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://cctraff.ru/strik?keyword=synonyms+and+antonyms+dictionary+pdf, https://uploads.strikinglycdn.com/files/62e1bee1-3785-4b9f-add3-ea132fe8fcdd/gixiwamijupemugitorawavaj.pdf, https://uploads.strikinglycdn.com/files/e92326b1-f8a4-4d3d-99b6-c26860aadd91/zijagi.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (10 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

10107 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787774471&P2=404&P3=2&P4=fH5YqErMS1zSx3%2fzbyRdn0vLPMOiav38D421yH%2fAHtpQc0Dg%2fEB2vBO4CiDx9YjECtMUVe8WPkOrlSeZl5GdFw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\ff2b9c9039ddba8c57f4d3398ef97e69.png - a9c43b31294eaff36622ee6258619004cc46e06571cea4ca22cd6dd6d77dcc02
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 121bd91d32f8ffc8905412336dbf4fe85c1a65919327a8beae7ec41dc3f46de2
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://cctraff.ru/strik?keyword=synonyms+and+antonyms+dictionary+pdf
https://uploads.strikinglycdn.com/files/62e1bee1-3785-4b9f-add3-ea132fe8fcdd/gixiwamijupemugitorawavaj.pdf
https://uploads.strikinglycdn.com/files/e92326b1-f8a4-4d3d-99b6-c26860aadd91/zijagi.pdf
https://uploads.strikinglycdn.com/files/428a6c6a-7cf9-4620-8d58-bf37b549e4b8/58074071080.pdf
https://uploads.strikinglycdn.com/files/b56f7518-3851-45f8-8d9d-cc34d640dc66/48608242643.pdf
https://uploads.strikinglycdn.com/files/2d8fc9d9-3715-49e8-9cb3-83da46ce7250/64996503594.pdf
https://cdn.shopify.com/s/files/1/0486/4321/1422/files/tom_waits_quotes_on_life.pdf
http://files.bloomwhereplanted.online/uploads/1/3/0/7/130739490/gifen.pdf
http://files.erinscreativedomain.com/uploads/1/3/2/8/132816041/sobebuvisam-telofadojovufa-gamowomonegogaz-muvelejivo.pdf
http://files.clbmg.com/uploads/1/3/2/8/132815807/5996800.pdf
http://giwuta.ewsevents.co.uk/uploads/1/3/1/1/131163890/duxozopuval-wisusitam-fezaz-vagag.pdf
https://cdn.shopify.com/s/files/1/0439/4136/3870/files/sri_manjunatha_songs.pdf
https://cdn.shopify.com/s/files/1/0432/9573/5963/files/japifowazanofebokilu.pdf
https://cdn.shopify.com/s/files/1/0437/8224/2466/files/dudipapabepabatosifibudu.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787774471&P2=404&P3=2&P4=fH5YqErMS1zSx3%2fzbyRdn0vLPMOiav38D421yH%2fAHtpQc0Dg%2fEB2vBO4CiDx9YjECtMUVe8WPkOrlSeZl5GdFw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

cctraff.ru
uploads.strikinglycdn.com
cdn.shopify.com
files.bloomwhereplanted.online
files.erinscreativedomain.com
files.clbmg.com
giwuta.ewsevents.co.uk
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

172.215.188.232
52.110.12.14
4.144.132.223
4.230.171.124
48.211.4.16
135.233.95.135
74.179.77.204
20.236.44.162
52.123.128.14
52.123.129.14
40.103.64.226
52.123.252.193
172.178.240.163
72.145.35.108
203.26.79.13
52.123.252.225
48.199.12.1
142.250.183.35

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report