MALICIOUS — normal_5f8a93e758413.pdf
MALICIOUS — normal_5f8a93e758413.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (72/100). 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
4f56153ebf9d2a35970d1bbc02f2271d92251a0d3c055adf8ae2deb0be6e9dd0 - SHA-1:
c0922d1ee817d07aa80dd5a37a719dfc74ec3446 - MD5:
abf90f4399dd19ad0b3d3fda66b3551e - ssdeep:
768:tgGzpDTeJTUyijv9E4zdFSDZ3at8pkUsOkkKR9juZHCVWBy/oz:OGFHeJOFYp48iUvkkIeHgSy/s - TLSH:
T182315CF310A7ED8C3B8F5F03A9AB15A9504AC78D623697905588772CC4BC6BD3F00A55 - Submitted as: normal_5f8a93e758413.pdf
- File type: pdf · Size: 41175 bytes
- Verdict: malicious (72/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 72/100 is the fusion of 6 weighted signals:
- Contacted 16 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/90199109-0dcd-46ae-a90c-effbc0649a8c/diguzogalalamulivow.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://cctraff.ru/123?keyword=nonlinear+computational+solid+mechanics+pdf, https://uploads.strikinglycdn.com/files/90199109-0dcd-46ae-a90c-effbc0649a8c/diguzogalalamulivow.pdf, https://uploads.strikinglycdn.com/files/bd04f79e-c596-467b-9954-f4c62299f527/14487834862.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Extracted generic config (10 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
9638 behavior events · 0 ATT&CK techniques · 3 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- c.pki.goog
- ntp.ubuntu.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787780828&P2=404&P3=2&P4=lRSy2uCtoFDY3I28alS8qzjVurB5QdFgvcWUVnLP8v2KU0ROq2T7AFiAey0KeGhzsw6ei%2b0fwJ68JbUYNzz0rA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787780885&P2=404&P3=2&P4=PFkQpuk2k%2fWgh0ojONmtZQQSG9xZww0qXStmONr02ZRcr%2fbQJaa34BKIGpxsCZqU0exkjUzRft3zf%2fAN8NHqSw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://c.pki.goog/r/gsr1.crl
Dropped files
- C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\e5c1be2219d7fd011f72e915285d3731.png -
7710a7d5b0cce4d19a08310c1eb2126fd784c93ce05b37891173afddc8779188 - C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt -
ef93ab7420ba8bae789ed00c12c24b0842ea1ebb8f3df55b4a54e11b4a3e404d - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://cctraff.ru/123?keyword=nonlinear+computational+solid+mechanics+pdf
- https://uploads.strikinglycdn.com/files/90199109-0dcd-46ae-a90c-effbc0649a8c/diguzogalalamulivow.pdf
- https://uploads.strikinglycdn.com/files/bd04f79e-c596-467b-9954-f4c62299f527/14487834862.pdf
- https://uploads.strikinglycdn.com/files/530f3e6d-ab85-4ffd-845a-9391ba86f675/51190437344.pdf
- https://uploads.strikinglycdn.com/files/93c22816-876f-44fb-b167-c2fec1755af3/jenenijokokotetovoko.pdf
- https://vimiwegom.weebly.com/uploads/1/3/0/7/130775837/d4f9789988777.pdf
- https://jufaxexave.weebly.com/uploads/1/3/0/7/130775513/jozepap.pdf
- https://vimiwegom.weebly.com/uploads/1/3/0/7/130775837/b8a7b22de405.pdf
- https://pesajupamobe.weebly.com/uploads/1/3/1/6/131607203/tuzulosujekaxegavez.pdf
- https://bedizegoresupa.weebly.com/uploads/1/3/1/3/131379398/zanazanekoxel.pdf
- https://cdn-cms.f-static.net/uploads/4372740/normal_5f8a8ae436b94.pdf
- https://cdn-cms.f-static.net/uploads/4374838/normal_5f8a1c259fe6a.pdf
- https://cdn-cms.f-static.net/uploads/4371787/normal_5f8a1c59e19d6.pdf
- https://cdn-cms.f-static.net/uploads/4375703/normal_5f8a19de9e9bd.pdf
- https://cdn-cms.f-static.net/uploads/4366389/normal_5f87fe5e73715.pdf
- https://vixijusodu.weebly.com/uploads/1/3/0/7/130776714/9731026.pdf
- https://xawuwotogot.weebly.com/uploads/1/3/2/6/132695388/8427769.pdf
- https://vozunutav.weebly.com/uploads/1/3/0/9/130969695/6949257.pdf
- https://fijojonibiw.weebly.com/uploads/1/3/2/6/132681787/613a711ec7ef.pdf
- https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/3029889.pdf
- https://dudikojegak.weebly.com/uploads/1/3/1/4/131406444/wexezuluva-bomezeganenodo-tujunimedinuda-xulamisekunu.pdf
- https://vuxozajuje.weebly.com/uploads/1/3/1/3/131379873/vunud.pdf
- https://buxivadoga.weebly.com/uploads/1/3/0/7/130740323/c8c81.pdf
- https://rimesozarabef.weebly.com/uploads/1/3/1/6/131607712/59e18c2f1d0bf5.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- cctraff.ru
- uploads.strikinglycdn.com
- vimiwegom.weebly.com
- jufaxexave.weebly.com
- pesajupamobe.weebly.com
- bedizegoresupa.weebly.com
- cdn-cms.f-static.net
- vixijusodu.weebly.com
- xawuwotogot.weebly.com
- vozunutav.weebly.com
- fijojonibiw.weebly.com
- jakedekokobara.weebly.com
- dudikojegak.weebly.com
- vuxozajuje.weebly.com
- buxivadoga.weebly.com
- rimesozarabef.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Embedded IP addresses
- 51.116.246.105
- 52.110.12.16
- 57.155.101.212
- 4.230.171.124
- 4.150.223.112
- 52.123.252.227
- 135.232.92.34
- 72.145.35.108
- 4.150.223.111
- 203.26.79.13
- 52.123.129.14
- 74.179.77.204
- 57.154.63.210
- 142.251.42.99
- 40.79.163.155
- 92.223.78.30
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report