MALICIOUS — normal_603180f88ebaa.pdf

MALICIOUS — normal_603180f88ebaa.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 59f5a4ca1a55318c588e0e2790004b378eadfb3eb1eb99dd8e739b916edaeb44
SHA-1: 21414e21b85dc15a48e9349e7bcdbe98ad6c5ed6
MD5: 948f0fa1fed3f20c45e36c9e48af7269
ssdeep: 1536:KgcL/FadMR3pGpt/HtqHNeQTtiCEYb5SGwVMsE:6L9adM3p3H7tiCEYbQGm8
TLSH: T16C37C0F32187DD0D7BC65F47BCAA112CA44BD78921329BA015C4BA6DD4786AE3F01E81
Submitted as: normal_603180f88ebaa.pdf
File type: pdf · Size: 70016 bytes
Verdict: malicious (98/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!948F0FA1FED3
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4409413/normal_5febed44934c8.pdf - network signal, weight 0.70, confidence 0.80
Contacted 21 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://druttle.ru/123?utm_term=craftsman+garage+door+opener+programming, https://cdn.sqhk.co/legusovej/jfidgjg/super_stickman_golf_2_play_online.pdf, http://erkutungotu.com/telugu_new_movies_2019_tamilrockersbmr4y.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9893 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
desktop-hsgcbep
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787775153&P2=404&P3=2&P4=hBuePgvQWB6R1D1BrGfznmmGkt6fWKYUKrmqyLEOCqYpWGP4h7aqKW0qPgo5kDnRGnFepLG7CUjC5YPTS%2bZHZA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787775237&P2=404&P3=2&P4=R1iUasV%2bqJ%2buTlxtW5FRofJ7f6uBWARSj41GZ6jNzf4XdeIb%2baUISV0HKX4fReBfMC3pgDk8dZY6ILgaM5cn4w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\7381a581d5b3aba429034246ed56a984.png - 1b4990029c0343300b528a0998bb787ef01abd5e1a38d4eae8aa9f3bb6bd2a87
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 6475b7c7bda5c27a7721e08bbf35718b724f7481a17472ef5016b4b9f205ca0b
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://druttle.ru/123?utm_term=craftsman+garage+door+opener+programming
https://cdn.sqhk.co/legusovej/jfidgjg/super_stickman_golf_2_play_online.pdf
http://erkutungotu.com/telugu_new_movies_2019_tamilrockersbmr4y.pdf
http://pobuwejugu.epizy.com/south_african_gas_installation_guidelines.pdf
https://cdn.sqhk.co/jogepirar/hgiggiP/sudoku_2020_wroclaw.pdf
https://cdn.sqhk.co/xoberuweri/jalu1jd/vector_security_customer_reviews.pdf
https://cdn.sqhk.co/togokitaz/pjg9Xgh/64096419674.pdf
https://static.s123-cdn-static.com/uploads/4409413/normal_5febed44934c8.pdf
https://cdn-cms.f-static.net/uploads/4369519/normal_60208fb3e909d.pdf
https://cdn.sqhk.co/xovikojux/igc0Nig/dynamons_world_2_mod_apk_hack.pdf
https://cdn.sqhk.co/vilubofi/jb9gcgf/free_bass_booster_app_for_spotify.pdf
http://perikovu.iblogger.org/buckethead_pikes_free.pdf
https://cdn-cms.f-static.net/uploads/4413109/normal_6011e2c91c71e.pdf
https://cdn-cms.f-static.net/uploads/4459785/normal_601a08cb2c05f.pdf
https://static.s123-cdn-static.com/uploads/4459478/normal_5ff0e0b657d44.pdf
http://chatik85939775.fun/23936130557yx9mz.pdf
https://cdn.sqhk.co/gefimiwotux/rgfYhEe/99540106531.pdf
http://pevitonorefiz.epizy.com/bangla_romantic_natok_2017_free.pdf
https://cdn.sqhk.co/wodelaganav/Ahgjajg/twilight_struggle_control_rules.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

druttle.ru
cdn.sqhk.co
erkutungotu.com
pobuwejugu.epizy.com
static.s123-cdn-static.com
cdn-cms.f-static.net
perikovu.iblogger.org
chatik85939775.fun
pevitonorefiz.epizy.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

162.159.142.9
52.123.252.212
52.110.12.5
52.110.12.2
4.230.171.124
52.253.84.76
135.232.92.137
20.165.94.54
20.231.239.246
20.184.175.5
52.123.128.14
40.103.64.226
74.178.232.29
72.145.35.96
203.26.79.13
172.178.240.161
20.42.179.204
4.209.250.170
142.250.195.131
20.184.175.20
4.150.223.109

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report