SUSPICIOUS — d93cd6.pdf
SUSPICIOUS — d93cd6.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (56/100). 3 of 50 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
5756c56fa0b62a67cd3d8f9eb79d6b263968aef8493d0d1fa8c3b14902b658f4 - SHA-1:
dc3fb9b0683f00b695e87993e845aed53f555c49 - MD5:
0ba3323d5928782918fd2444fab99cf9 - ssdeep:
1536:ZGFGp1HQKF+TjNvFZDkqwzKL2UQgsh1HTTWHJB6S0WGHm3mf:sFGp1HHFOrCKL2UzsTHvWpB6SAmS - TLSH:
T14638CFF350EBDE8CBA839B979CA615A5544EDB4C7632DB5014887B2CC4BC27D6F00A90 - Submitted as: d93cd6.pdf
- File type: pdf · Size: 79570 bytes
- Verdict: suspicious (56/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 56/100 is the fusion of 6 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=thani%20oruvan%20movie%20online%20with%20engli, https://cdn-cms.f-static.net/uploads/4376358/normal_5f8b0b833fc6f.pdf, https://cdn-cms.f-static.net/uploads/4375355/normal_5f8fe8304a7b8.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Contacted 8 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
9814 behavior events · 1 ATT&CK techniques · 3 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- searchapp.bundleassets.example
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- desktop-hsgcbep
- 250.255.255.239.in-addr.arpa
- ntp.ubuntu.com
- 79.243.254.169.in-addr.arpa
- 255.255.254.169.in-addr.arpa
- desktop-hsgcbep._dosvc._tcp.local
- desktop-hsgcbep(1)._dosvc._tcp.local
Dropped files
- C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\080b4825e470c0951301c63d6cd6a38b.png -
b4961de1a50aa52dac9c10c9dce732d13605d2964cbc0ebaf6c8f6d09a89758b - C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt -
00b504fde9583a248ed6600b49f12e3bbb7d1cfb1d6fa3c33d476db2e2dcb12e - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://gettraff.ru/wb?keyword=thani%20oruvan%20movie%20online%20with%20engli
- https://cdn-cms.f-static.net/uploads/4376358/normal_5f8b0b833fc6f.pdf
- https://cdn-cms.f-static.net/uploads/4375355/normal_5f8fe8304a7b8.pdf
- https://cdn-cms.f-static.net/uploads/4375199/normal_5f8a1655dc180.pdf
- https://cdn-cms.f-static.net/uploads/4365627/normal_5f90e76644338.pdf
- https://cdn-cms.f-static.net/uploads/4369516/normal_5f8a8290ee757.pdf
- https://cdn.shopify.com/s/files/1/0434/1789/5070/files/ps2_emulator_android_multiplayer.pdf
- https://cdn.shopify.com/s/files/1/0435/7039/7352/files/android_10_note_10_plus_verizon.pdf
- https://cdn.shopify.com/s/files/1/0469/0349/2770/files/fake_gps_location_android_tinder.pdf
- https://s3.amazonaws.com/zetare/complete_guide_to_the_revolutionary_platform_business_model.pdf
- https://s3.amazonaws.com/pazifetanegapu/54288813419.pdf
- https://s3.amazonaws.com/wonoti/jomudakigokukenubobixefir.pdf
- https://s3.amazonaws.com/kavitokolezub/juxalosegiruxujukikox.pdf
- https://cdn.shopify.com/s/files/1/0431/0482/9589/files/jos_leduc_wrestling.pdf
- https://cdn.shopify.com/s/files/1/0496/0747/5352/files/riselenagaxuravuzos.pdf
- https://cdn.shopify.com/s/files/1/0462/3876/1109/files/clock_icon_in_status_bar_android.pdf
- https://cdn.shopify.com/s/files/1/0438/5302/1334/files/naziduxame.pdf
- https://uploads.strikinglycdn.com/files/fab4f203-3c61-41b1-8dd0-0f866881d70d/ps_form_2976_fillable.pdf
- https://uploads.strikinglycdn.com/files/0ca3f390-27d9-4c10-b7ce-f67ea4cc506a/xakeperoz.pdf
- https://uploads.strikinglycdn.com/files/9e23a9fb-8852-4b1d-ab26-d48ecbca7de2/49369921431.pdf
- https://cdn-cms.f-static.net/uploads/4374178/normal_5f8d02767b488.pdf
- https://cdn-cms.f-static.net/uploads/4375070/normal_5f8ed8933c1a2.pdf
- https://cdn-cms.f-static.net/uploads/4369330/normal_5f87b537a37cd.pdf
- https://cdn-cms.f-static.net/uploads/4380890/normal_5f8f9a59d5151.pdf
- https://cdn-cms.f-static.net/uploads/4381091/normal_5f8f6ab90fb44.pdf
Embedded domains
- gettraff.ru
- cdn-cms.f-static.net
- cdn.shopify.com
- s3.amazonaws.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Embedded IP addresses
- 40.79.141.153
- 52.110.12.44
- 74.178.232.29
- 72.145.35.101
- 57.155.104.224
- 162.159.36.2
- 40.99.134.18
- 4.230.171.124
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report