SUSPICIOUS — 54326212252.pdf
SUSPICIOUS — 54326212252.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (64/100). 2 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
48080c2e6f18e8d361b4f8a872e94ce6bbefbdf40d6225725d5b0e265d5c8025 - SHA-1:
2544c648ebf682a62d8c61e9a419e40a704917b4 - MD5:
303872734559354e0465ef4393ca4f9f - ssdeep:
768:zgGzpDoRrHzyJRyVUAqJ2EwKVPs2Aq8yKIyT7D1TVKvtm/Hf1W0U/1z/:MGF8CDkKps2Aqn0j1xKvtmvf1W0u1z/ - TLSH:
T19933BFF300A7ED4C2A85EB037CEA106A614AC78CB133B7A4595D367CD57C5BDAE20920 - Submitted as: 54326212252.pdf
- File type: pdf · Size: 49050 bytes
- Verdict: suspicious (64/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 64/100 is the fusion of 5 weighted signals:
- Contacted 18 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://ggtraff.ru/strik?keyword=superconductivity+mcq+pdf, https://cdn.shopify.com/s/files/1/0499/3145/2574/files/50993553477.pdf, https://cdn.shopify.com/s/files/1/0430/9640/8218/files/libifulej.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Extracted generic config (5 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
9814 behavior events · 0 ATT&CK techniques · 3 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ntp.ubuntu.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787766260&P2=404&P3=2&P4=iRddv3z33ZQKS6qVJAVR798TxVDkxct%2bH8y7BBSPn%2b%2bkB6h%2bnzoE%2biL%2b8ILKjnSfs0fOTO4gtL%2fCmrkcKO0inQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787766323&P2=404&P3=2&P4=Pixr4cNtGLHMRCYaV6jN%2fKj0Z84ByD5y1FwuT9112c5PbdEEkw0Ais3NrZrLNnewnh8JKxP4hVEMzMHaXqaZUw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
Dropped files
- C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt -
2eba6aa35ce031475c31f0ef67b47a2fea6eae40150ed4ddbdde4b818f3b3525 - C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\285bb2ed81e14b7f06e41a505a8f3941.png -
88b3e248c8fd2e74e992ba08a7b88b470d4b549cf9b728a5054bc1f4e6fdd3e7 - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://ggtraff.ru/strik?keyword=superconductivity+mcq+pdf
- https://cdn.shopify.com/s/files/1/0499/3145/2574/files/50993553477.pdf
- https://cdn.shopify.com/s/files/1/0430/9640/8218/files/libifulej.pdf
- https://cdn.shopify.com/s/files/1/0435/6138/6147/files/how_far_is_hawaii_from_california_by_car.pdf
- https://cdn.shopify.com/s/files/1/0482/8944/8091/files/sam_flynn_tron.pdf
- https://cdn.shopify.com/s/files/1/0434/7609/1045/files/46917602074.pdf
- https://site-1036861.mozfiles.com/files/1036861/97113368001.pdf
- https://site-1037251.mozfiles.com/files/1037251/dozilipuzawekegixe.pdf
- https://site-1039577.mozfiles.com/files/1039577/vozakidozuvesidu.pdf
- https://site-1038867.mozfiles.com/files/1038867/tisonepek.pdf
- https://cdn.shopify.com/s/files/1/0433/8938/6917/files/bakezijosupuw.pdf
- https://cdn.shopify.com/s/files/1/0468/8232/4637/files/billy_and_mandy_save_christmas_itunes.pdf
- https://cdn.shopify.com/s/files/1/0483/4253/2247/files/r180_white_pill_high.pdf
- https://cdn.shopify.com/s/files/1/0498/6624/4251/files/freedom_writers_discussion_questions_answers.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787766260&P2=404&P3=2&P4=iRddv3z33ZQKS6qVJAVR798TxVDkxct%2bH8y7BBSPn%2b%2bkB6h%2bnzoE%2biL%2b8ILKjnSfs0fOTO4gtL%2fCmrkcKO0inQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- ggtraff.ru
- cdn.shopify.com
- site-1036861.mozfiles.com
- site-1037251.mozfiles.com
- site-1039577.mozfiles.com
- site-1038867.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Embedded IP addresses
- 52.110.12.28
- 57.154.63.210
- 4.230.171.124
- 172.215.188.225
- 20.247.185.124
- 92.223.78.30
- 74.178.240.51
- 20.76.201.171
- 52.123.128.14
- 13.69.116.104
- 135.232.92.137
- 135.233.95.80
- 203.26.79.13
- 4.150.223.97
- 40.84.97.4
- 172.170.180.133
- 4.150.223.110
- 142.250.195.163
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report