MALICIOUS — normal_6046248b024a4.pdf
MALICIOUS — normal_6046248b024a4.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 50 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
598409c62a60a90c15b171216f2c23e896e828849ff3b25d7fa2eb954d5ba849 - SHA-1:
92cb3051fa262651f4682df361273d92446815a9 - MD5:
7a704a8c9186b1416a92f0949aeafcb3 - ssdeep:
3072:jB0TY/WfxuAvGm2xVL8tYrQaAP8vDKnKabE7qlAWt5wQ:2T6WpuAvGmHt3aAUuB4RIz - TLSH:
T1B13DE1F35153ED0DB74AAF07BCAA24A8A15DD38870326B500198F65CD8782ED7F90E91 - Submitted as: normal_6046248b024a4.pdf
- File type: pdf · Size: 128824 bytes
- Verdict: malicious (99/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 9 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Dropped a malicious payload (Lazarus): root_.cache_dconf_user - dynamic signal, weight 0.80, confidence 0.90
- Embedded link rated malicious by URL analysis: https://80c8fd16-4cf8-4f9f-b52b-d6c956df8f3b.filesusr.com/ugd/1a94e8_9c116d5f83b34d96b28c51d6327aab22.pdf?index=true - network signal, weight 0.70, confidence 0.80
- Contacted 33 external host(s) at runtime (7 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://xajibur.ru/123?utm_term=hematology+laboratory+pdf, http://vegifeda.mypressonline.com/kekewonenisosobosovis.pdf, https://80c8fd16-4cf8-4f9f-b52b-d6c956df8f3b.filesusr.com/ugd/1a94e8_9c116d5f83b34d96b28c51d6327aab22.pdf?index=true - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
9786 behavior events · 1 ATT&CK techniques · 4 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- desktop-hsgcbep
- 250.255.255.239.in-addr.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- ntp.ubuntu.com
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Dropped files
- /opt/CAPEv2/storage/analyses/31280/files/4ca776a807bfc60864754324bbaf1c82b95e22eacd7c9fa4c7ce52417d9b9677 -
4ca776a807bfc60864754324bbaf1c82b95e22eacd7c9fa4c7ce52417d9b9677 - /opt/CAPEv2/storage/analyses/31280/files/bb8e8e3d67339826f44dcec93849972e4e1406113d997bfe78f32160f2776adb -
bb8e8e3d67339826f44dcec93849972e4e1406113d997bfe78f32160f2776adb - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7 - tmp_tmp.aOvrAPQjBz -
17086490d5ca9fc9f0bca00ed2fb56589ac73c822a8b302137d53b258f661eb6
Embedded URLs
- https://xajibur.ru/123?utm_term=hematology+laboratory+pdf
- http://vegifeda.mypressonline.com/kekewonenisosobosovis.pdf
- https://80c8fd16-4cf8-4f9f-b52b-d6c956df8f3b.filesusr.com/ugd/1a94e8_9c116d5f83b34d96b28c51d6327aab22.pdf?index=true
- https://cee4a208-09ac-40e0-983f-4c2cc776acbe.filesusr.com/ugd/5ed537_f836523ae264493ba29f5147d0ed82f7.pdf?index=true
- https://21e323bd-7fdd-46e9-a6c7-4880e76d7610.filesusr.com/ugd/0a51c1_f0796f407e044497abe3744098127bd1.pdf?index=true
- http://tewowes.rf.gd/33814517147.pdf
- https://f72b89be-0fa6-41ee-8162-331329ef78ce.filesusr.com/ugd/95089d_86e048deaca945dd8e260b2ca0663c17.pdf?index=true
- https://dajidavibaral.weebly.com/uploads/1/3/4/6/134606929/5aa797c7d6c2350.pdf
- https://770ad53b-b55e-4e58-b1eb-3709f41304f7.filesusr.com/ugd/98e298_2e69a8877e6d49eaacd3321ade200625.pdf?index=true
- http://bomawowaziwan.iblogger.org/47182595053.pdf
- http://jetedobov.epizy.com/91079793273.pdf
- http://towonededuv.medianewsonline.com/how_to_adjust_vizio_sound_bar_without_remote.pdf
- https://a5a7f18c-b887-48a0-80cc-3627c14345d5.filesusr.com/ugd/609f59_b64343216aa449ada0e18f0a649d0324.pdf?index=true
- http://wakerot.epizy.com/strength_training_workout_no_weights.pdf
- https://sojagifuwolu.weebly.com/uploads/1/3/4/6/134689160/5991982.pdf
- https://6205d428-d5dc-494e-bbc3-e2236f9d811e.filesusr.com/ugd/6885a6_80d5139a480841b0bbedeb19f8e00f1b.pdf?index=true
- https://bixikobitil.weebly.com/uploads/1/3/4/5/134525497/8e4a3e.pdf
- http://devovonabukuzim.66ghz.com/61185828108.pdf
- https://af431a04-9ebc-4ea4-a98d-45e4ffbfad14.filesusr.com/ugd/485053_ed8432fe47e2437ab93f159024cbd68d.pdf?index=true
- https://f3c4034a-4a94-4c47-b6c5-0445626d7bf8.filesusr.com/ugd/655f09_fae0f6135521481495434c62c667de50.pdf?index=true
- https://5fa60de5-32ab-41ac-ba65-77330e21e623.filesusr.com/ugd/2e16aa_8db392a6afe1429ba29698237608cea7.pdf?index=true
- https://c6111751-42b6-464f-a8b1-832d492ff999.filesusr.com/ugd/3d0627_5e3ccf1b40964ae8af70bb14f7baec69.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- xajibur.ru
- vegifeda.mypressonline.com
- 80c8fd16-4cf8-4f9f-b52b-d6c956df8f3b.filesusr.com
- cee4a208-09ac-40e0-983f-4c2cc776acbe.filesusr.com
- 21e323bd-7fdd-46e9-a6c7-4880e76d7610.filesusr.com
- f72b89be-0fa6-41ee-8162-331329ef78ce.filesusr.com
- dajidavibaral.weebly.com
- 770ad53b-b55e-4e58-b1eb-3709f41304f7.filesusr.com
- bomawowaziwan.iblogger.org
- jetedobov.epizy.com
- towonededuv.medianewsonline.com
- a5a7f18c-b887-48a0-80cc-3627c14345d5.filesusr.com
- wakerot.epizy.com
- sojagifuwolu.weebly.com
- 6205d428-d5dc-494e-bbc3-e2236f9d811e.filesusr.com
- bixikobitil.weebly.com
- devovonabukuzim.66ghz.com
- af431a04-9ebc-4ea4-a98d-45e4ffbfad14.filesusr.com
- f3c4034a-4a94-4c47-b6c5-0445626d7bf8.filesusr.com
- 5fa60de5-32ab-41ac-ba65-77330e21e623.filesusr.com
- c6111751-42b6-464f-a8b1-832d492ff999.filesusr.com
- www.w3.org
- purl.org
- ns.adobe.com
- tewowes.rf.gd
Embedded IP addresses
- 4.150.223.100
- 125.56.205.32
- 52.123.252.241
- 4.230.171.124
- 52.110.12.25
- 52.230.59.222
- 74.178.240.61
- 74.179.77.164
- 52.123.129.14
- 40.104.4.2
- 135.234.160.246
- 52.123.252.243
- 72.154.7.104
- 203.26.79.13
- 52.123.252.215
- 20.184.175.7
- 135.233.45.221
- 52.148.114.188
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report