MALICIOUS — normal_5fc9fbe89897c.pdf

MALICIOUS — normal_5fc9fbe89897c.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 4df3168e73272eb0033af9980f626079c135d55af481e27c108295563bab8e52
SHA-1: cb9909a34d618cf3c7913cae6e14dc9404c5929c
MD5: 108eaada5068de64ccd1e64f9b9993cf
ssdeep: 1536:n69za9t9I3YMk647yviL/GbdcSkyN6wC9PybB5r9m1:6kt0R47ciL/gdc3yNHCRybrrq
TLSH: T1CA35D0F3A187DC48E7DA67136F7E0438B15AC2596136E7A404C47A3CC9A837C3E20A91
Submitted as: normal_5fc9fbe89897c.pdf
File type: pdf · Size: 59566 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://uploads.strikinglycdn.com/files/cba5dba9-2191-4390-89f0-2d8e9379f585/vikiluvizulutixe.pdf - network signal, weight 0.70, confidence 0.80
Contacted 16 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://trafffi.ru/123?utm_term=gas+variables+pogil+packet+answers, https://regumalewa.weebly.com/uploads/1/3/4/6/134694163/jemezeji-kubegezaxip-datujupemobufun.pdf, https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd011a72f8b574a0f3fd72/1606222112480/vulafivenumusapowuga.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (5 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9658 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
79.243.254.169.in-addr.arpa
255.255.254.169.in-addr.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\ac1a302f0e28a55c9f3ba384ea20379b.png - 6b34e440c093999e668d216b89f0f1ea5487739f57c4403c8763f63d8f904eb3
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - daf58c5c5687e5610be6272640d4fdca23e26e7d17b7880bb6ba9e97d87610c8
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://trafffi.ru/123?utm_term=gas+variables+pogil+packet+answers
https://regumalewa.weebly.com/uploads/1/3/4/6/134694163/jemezeji-kubegezaxip-datujupemobufun.pdf
https://s3.amazonaws.com/xanunafojuloki/ascorbic_acid_usp_monograph.pdf
https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd011a72f8b574a0f3fd72/1606222112480/vulafivenumusapowuga.pdf
https://cdn-cms.f-static.net/uploads/4497697/normal_5fc1a04335056.pdf
https://uploads.strikinglycdn.com/files/cba5dba9-2191-4390-89f0-2d8e9379f585/vikiluvizulutixe.pdf
https://cdn-cms.f-static.net/uploads/4390350/normal_5fc20d67dc6fd.pdf
https://cdn-cms.f-static.net/uploads/4365563/normal_5f8f60f511a5c.pdf
https://panidulupeju.weebly.com/uploads/1/3/0/9/130969186/5292646.pdf
https://gimifuzakid.weebly.com/uploads/1/3/4/3/134315082/boxujozikojenuj_kerijotut_mufodutibi.pdf
https://donixefafara.weebly.com/uploads/1/3/4/3/134310569/sebavo-dujemujanosajaw-direvozeguk-jaxuwe.pdf
https://bedizegoresupa.weebly.com/uploads/1/3/1/3/131379398/lulodegoner.pdf
https://benipotuwazel.weebly.com/uploads/1/3/4/4/134445242/55a90f51b72.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787732726&P2=404&P3=2&P4=EW%2bM9h52BYp0AUDb8%2fddJyuapPj9HCCaflI1K2sKi0QHcIBi31bh8tF1ST%2fg3dmRkgxGBdo892XRXGy2oztdgg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

trafffi.ru
regumalewa.weebly.com
s3.amazonaws.com
static1.squarespace.com
cdn-cms.f-static.net
uploads.strikinglycdn.com
panidulupeju.weebly.com
gimifuzakid.weebly.com
donixefafara.weebly.com
bedizegoresupa.weebly.com
benipotuwazel.weebly.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

72.154.7.113
57.154.63.210
52.110.12.44
4.230.171.124
52.253.84.76
20.165.94.63
135.233.95.135
40.99.134.2
52.123.129.14
40.103.64.226
40.99.133.226
74.179.71.159
203.26.79.13
52.123.252.243
172.175.111.170
52.178.17.234

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report