MALICIOUS — 61421465804.pdf

MALICIOUS — 61421465804.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100). 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 54cf56d0e505dafd3faa36a14561b309e86d97ef6cbab4ff381f01946e3d2d5f
SHA-1: 13e407fcfce27522e4a2a3d308195c14743fb3ab
MD5: 73d16be7324cdd4480b2dd7942701542
ssdeep: 768:tgGzpDbEtNXhHXKTEQKJb1LiFckAmFoccsNVT93EgEE3MXVbgI:OGFHUNXhaTMkAoxRPl/L3MXVbgI
TLSH: T134319EF310A7ED8C6A8A9B1779A21129B14ED748317387A049D8B63CC8BC7FD6E10D51
Submitted as: 61421465804.pdf
File type: pdf · Size: 42302 bytes
Verdict: malicious (84/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 84/100 is the fusion of 6 weighted signals:

Embedded link rated malicious by URL analysis: https://uploads.strikinglycdn.com/files/f3b74252-df66-46e1-a327-766b4d0b33dc/14755705498.pdf - network signal, weight 0.70, confidence 0.80
Contacted 20 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://cctraff.ru/strik?keyword=pdf+ac+dressing+ampoule+mask, http://zajot.artoftranscendence-tantra.com/uploads/1/3/2/8/132814241/ferinitegixegomovuk.pdf, http://files.abesoutfitters.com/uploads/1/3/2/6/132681477/refategejipafe.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (8 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9710 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
desktop-hsgcbep
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\2d91e371901340d230bfba3754001448.png - 564cb861919b341f972458d917b051bb41af8602584ce08c6673c04cdafd2256
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - fae42be2c4482f8b89ede29f3f852a4b14944f7f02eb1abf5a01f849952cc757
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://cctraff.ru/strik?keyword=pdf+ac+dressing+ampoule+mask
http://zajot.artoftranscendence-tantra.com/uploads/1/3/2/8/132814241/ferinitegixegomovuk.pdf
http://files.abesoutfitters.com/uploads/1/3/2/6/132681477/refategejipafe.pdf
http://juzero.kathrynyancey.com/uploads/1/3/0/8/130814328/wuranufunibujor_jegiga_vamilapo_mefuvevajigut.pdf
http://files.professordos.net/uploads/1/3/2/7/132740338/zevidufe_fumamekiwafoluz.pdf
https://uploads.strikinglycdn.com/files/23cb073c-78f9-4c3b-8536-d89cd625d005/12764348323.pdf
https://uploads.strikinglycdn.com/files/43edc1b8-cf1f-4586-a435-0b8154669527/49454928372.pdf
https://uploads.strikinglycdn.com/files/f3b74252-df66-46e1-a327-766b4d0b33dc/14755705498.pdf
https://cdn.shopify.com/s/files/1/0432/8128/5286/files/54860697544.pdf
https://cdn.shopify.com/s/files/1/0481/2659/1139/files/how_to_dance_on_roblox_high_school.pdf
https://cdn.shopify.com/s/files/1/0430/8189/1989/files/39455983743.pdf
https://cdn.shopify.com/s/files/1/0468/0636/8407/files/bumofoxetutizovuwolusiji.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787754807&P2=404&P3=2&P4=Hl4ylJRdbZcb%2b2gMOWdtNFh78uxblSLM0mTqhFT9wI%2fwJSBsDSFVudsrmlzcOatD%2f0uQolgFJRK8PIiXosQxlw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787754878&P2=404&P3=2&P4=FlMe%2b2bGradhLRycp5%2bYSQw2FdGDsdhipQsP2G%2fg8CGkQX7rkhi1bXFECX%2fwBiqg1dqqXrc1wihbEcGtMAvFdQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

cctraff.ru
zajot.artoftranscendence-tantra.com
files.abesoutfitters.com
juzero.kathrynyancey.com
files.professordos.net
uploads.strikinglycdn.com
cdn.shopify.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

20.184.175.11
20.42.73.26
104.208.16.94
52.123.252.232
52.110.12.55
4.230.171.124
57.155.101.212
203.26.79.13
20.165.94.54
74.178.240.61
52.178.17.3
40.99.133.210
52.123.129.14
135.234.160.244
135.232.92.34
57.155.104.224
20.184.175.5
172.178.240.163
172.170.180.133
4.150.223.109

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report