MALICIOUS — 50646736287.pdf

MALICIOUS — 50646736287.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100). 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 4988639540f34b4802534651808937bc5504157b06fd1b0fc7bd6f4b93d8a9be
• SHA-1: 04fa072e81e6a0c9622bb4b70fa93b057a501ea1
• MD5: 6c9c78f94f93335a7f9f18dc938774e1
• ssdeep: 768:mgGzpD9OB7E3ERJpZA+Y8XCLkQ3y2cvzZNPabwLkX7J:zGFpci38K3VcLZVabwLkX7J
• TLSH: T16B318DF710A7ED8C7BC6AB03ADA71158644A87483227DBA445C8772DC8BC2AD7E10970
• Submitted as: 50646736287.pdf
• File type: pdf · Size: 41983 bytes
• Verdict: malicious (84/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

• T1105
• T1566.002

Why this verdict

The malicious score of 84/100 is the fusion of 6 weighted signals:

• Embedded link rated malicious by URL analysis: https://uploads.strikinglycdn.com/files/8d08c54f-5370-4493-8407-ae399311479f/solokizomawibodesedizi.pdf - network signal, weight 0.70, confidence 0.80
• Contacted 18 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=japanese+from+zero+3+pdf, http://balepusu.futurewire.org/uploads/1/3/0/9/130969130/bikil-vumoxozozanisi.pdf, http://bebuvawa.summerfry.com/uploads/1/3/2/6/132682137/zarikidududexategomu.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Extracted generic config (15 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9748 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• c.pki.goog
• desktop-hsgcbep
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• 250.255.255.239.in-addr.arpa
• ntp.ubuntu.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

• C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\7ed26852dec014030fbb318be9334cf7.png - 45b3df6cf778d26639cd76d385932aafb618e5e3500ebee3b11a810959166f93
• C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 0ebfe8d88a3c75bfd08caf304e4731f91ff3590514f274851f18bc6adff7d3c2
• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://ggtraff.ru/strik?keyword=japanese+from+zero+3+pdf
• http://balepusu.futurewire.org/uploads/1/3/0/9/130969130/bikil-vumoxozozanisi.pdf
• http://bebuvawa.summerfry.com/uploads/1/3/2/6/132682137/zarikidududexategomu.pdf
• http://files.harwintoncongucc.org/uploads/1/3/0/9/130969845/5277205.pdf
• http://xirur.springer-acehomes.com/uploads/1/3/0/9/130969465/656fe99a8d59.pdf
• http://files.rhenitauchid.com/uploads/1/3/1/4/131407668/1b3844c626.pdf
• https://cdn.shopify.com/s/files/1/0438/6629/2389/files/27621968681.pdf
• https://cdn.shopify.com/s/files/1/0431/8547/1656/files/pobujivujewitefofamev.pdf
• https://uploads.strikinglycdn.com/files/ee1e6372-62e9-40f1-96fa-96015e227f78/49063619503.pdf
• https://uploads.strikinglycdn.com/files/4e4d43b1-1e95-4971-8cff-d683f718434a/52428790067.pdf
• https://uploads.strikinglycdn.com/files/c99adaf9-da90-4951-b0bd-c36c5c247298/65610409143.pdf
• https://uploads.strikinglycdn.com/files/8d08c54f-5370-4493-8407-ae399311479f/solokizomawibodesedizi.pdf
• https://uploads.strikinglycdn.com/files/95fff19a-7a9f-4774-95aa-a3e684364426/rilupurikitek.pdf
• https://uploads.strikinglycdn.com/files/645c315a-f3a5-42ec-9f63-69d9d9c8dbda/wumubofas.pdf
• https://uploads.strikinglycdn.com/files/195d2a57-9838-41b7-8a07-9049da8ef99c/33599573032.pdf
• https://uploads.strikinglycdn.com/files/4e173b45-15f4-4c75-86ad-54f0b866dc84/69165677616.pdf
• https://uploads.strikinglycdn.com/files/96290ff1-62d5-4686-9637-344bc539c408/vulebuwowanokasedej.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Embedded domains

• ggtraff.ru
• balepusu.futurewire.org
• bebuvawa.summerfry.com
• files.harwintoncongucc.org
• xirur.springer-acehomes.com
• files.rhenitauchid.com
• cdn.shopify.com
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com

Embedded IP addresses

• 172.172.255.217
• 57.155.104.224
• 52.110.12.56
• 4.230.171.124
• 20.3.4.127
• 203.26.79.13
• 135.233.95.144
• 135.233.95.135
• 20.76.201.171
• 52.123.129.14
• 52.123.252.194
• 172.178.240.161
• 52.123.252.223
• 172.215.188.225
• 142.250.207.3
• 4.209.250.170
• 52.168.117.168
• 92.223.78.30

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report