MALICIOUS — 3d514e_3ae72a779a264acbac3d114ab4c90e4c.pdf
MALICIOUS — 3d514e_3ae72a779a264acbac3d114ab4c90e4c.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100). 3 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
43904e5248f3c2c2b044cf18a42f32f89492a5e22bf5aa9155b0e329c06e7407 - SHA-1:
efb4151858e5466b5c889caede572e4a12f5484c - MD5:
b75533382636b66bbdf91f184da5407b - ssdeep:
768:3gGzpDDyHJpJg7oonCzcbduk6RlK+og0kGJrxxAL1d/jSYCBc5L1Y6:QGFPwEQOU3lNCkk9x81dL7CBc5L1Y6 - TLSH:
T1FA33CFF31197EC882B8B5F436EAA20555146D28CB13AA32009DD7A6DD5B87FCEE40D70 - Submitted as: 3d514e_3ae72a779a264acbac3d114ab4c90e4c.pdf
- File type: pdf · Size: 49202 bytes
- Verdict: malicious (89/100)
Detections (3 of 54 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 89/100 is the fusion of 8 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ttraff.cc/wix?keyword=dunmore+dmv+pa, https://fe1f0ca4-4e52-4f21-ab09-eda1b3f72b4b.filesusr.com/ugd/2ac701_b8bae5ca3e124885911209716f7fbdb9.pdf?index=true, https://ca1b20b3-a59f-4a7f-b117-782c55d12975.filesusr.com/ugd/2e16aa_59f13711a728496d80396945a7246092.pdf?index=true - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Contacted 9 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (12 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
1002 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- searchapp.bundleassets.example
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- to-do.office.com
- ntp.ubuntu.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- 192.168.122.110
- 23.40.52.121
- 23.11.37.157
- 162.159.142.9 US · San Francisco · AS13335 Cloudflare, Inc.
- 23.33.238.114
- 20.165.94.46 US · San Antonio · AS8075 Microsoft Corporation
- 72.145.35.104 IE · Dublin · AS8075 Microsoft Corporation
Dropped files
- root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://ttraff.cc/wix?keyword=dunmore+dmv+pa
- https://fe1f0ca4-4e52-4f21-ab09-eda1b3f72b4b.filesusr.com/ugd/2ac701_b8bae5ca3e124885911209716f7fbdb9.pdf?index=true
- https://ca1b20b3-a59f-4a7f-b117-782c55d12975.filesusr.com/ugd/2e16aa_59f13711a728496d80396945a7246092.pdf?index=true
- https://fe99b54a-b682-4740-9828-dc71e237d6ef.filesusr.com/ugd/529dbf_ccfb31305f0444cfbe6abc850d37d3ba.pdf?index=true
- https://0ca92319-70b7-41f4-81ae-e3a3cf1b5b1d.filesusr.com/ugd/93c935_d80aa31306aa481393db15dad8f265ae.pdf?index=true
- https://f7c41397-cc3c-44e3-9bcc-9843cebf5b2e.filesusr.com/ugd/271e65_b634b257242b4cb5b2b821da4e295fc9.pdf?index=true
- http://files.nottingham-north.org.uk/uploads/1/3/0/9/130968933/kupunuvulemekid-sepujuzox.pdf
- http://files.thegeorgiaruthhouse.com/uploads/1/3/1/4/131438228/wakebuv-jujeze-vipat.pdf
- https://cdn.shopify.com/s/files/1/0435/7698/3713/files/8021549015.pdf
- https://cdn.shopify.com/s/files/1/0440/1682/8581/files/coco_remember_me_lullaby_piano_sheet_music.pdf
- https://cdn.shopify.com/s/files/1/0434/0056/0803/files/86848473849.pdf
- https://a4c78e1f-c7ed-4c73-b469-42db715777be.filesusr.com/ugd/405339_0409e3aa76fd4bf8a38d08383011d147.pdf?index=true
- https://d11eef85-afe8-4db0-9254-c766fb9d5a7a.filesusr.com/ugd/9058e5_9c1ac1bc3b914d438b4fb59c7e91f788.pdf?index=true
- https://343c21e8-fb6a-4ff3-9fed-e3048fd3ee11.filesusr.com/ugd/696117_b56939fb6c88477795c6438c3f60ed49.pdf?index=true
- https://9d7c6ec5-f462-483b-b493-05c8e4fa393d.filesusr.com/ugd/31593d_52b8885f55614f2d824d0a08a3e07b25.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- ttraff.cc
- fe1f0ca4-4e52-4f21-ab09-eda1b3f72b4b.filesusr.com
- ca1b20b3-a59f-4a7f-b117-782c55d12975.filesusr.com
- fe99b54a-b682-4740-9828-dc71e237d6ef.filesusr.com
- 0ca92319-70b7-41f4-81ae-e3a3cf1b5b1d.filesusr.com
- f7c41397-cc3c-44e3-9bcc-9843cebf5b2e.filesusr.com
- files.nottingham-north.org.uk
- files.thegeorgiaruthhouse.com
- cdn.shopify.com
- a4c78e1f-c7ed-4c73-b469-42db715777be.filesusr.com
- d11eef85-afe8-4db0-9254-c766fb9d5a7a.filesusr.com
- 343c21e8-fb6a-4ff3-9fed-e3048fd3ee11.filesusr.com
- 9d7c6ec5-f462-483b-b493-05c8e4fa393d.filesusr.com
- www.w3.org
- purl.org
- ns.adobe.com
Embedded IP addresses
- 162.159.142.9
- 20.165.94.46
- 72.145.35.104
- 52.110.12.4
- 92.223.78.30
- 40.103.64.226
- 162.159.36.2
- 203.26.79.13
- 34.104.35.123
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report