MALICIOUS — 23732838508.pdf

MALICIOUS — 23732838508.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (72/100). 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 5ac278643aedd3083eea11a5515b52160c620b200d5621d05beae623fbc694f1
SHA-1: cc5729a57cc8c21208a34c58591550919b7eb56a
MD5: b497b5b6dc0eebaad7b85d6f31bbad14
ssdeep: 768:zgGzpDfZl9g/Si9IsqX83xEZHI7QIkASAssnN9McVdwX8MDwYWIZXgN:MGFjkAsoHydE0N3dw/DFWIZXgN
TLSH: T14A319DF354ABEE8C3A8AAB035DE60159658AC38C6036976088DC7B3CD47C5BD7E10861
Submitted as: 23732838508.pdf
File type: pdf · Size: 41801 bytes
Verdict: malicious (72/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 72/100 is the fusion of 6 weighted signals:

Contacted 14 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://files.greenleafpsychological.com/uploads/1/3/2/3/132302892/durejanilafuf-nobixu-xusowu-vibowat.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://cctraff.ru/strik?keyword=becoming+supernatural+joe+dispenza+ebook, https://cdn.shopify.com/s/files/1/0440/5723/1525/files/71609730083.pdf, https://cdn.shopify.com/s/files/1/0436/2692/2147/files/nesopina.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9720 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787778486&P2=404&P3=2&P4=es6aoWg3V1gwxuwuhpAyt9GqSTDPrgTaC8qyfh06Kr5Zr8CNvvX6z8ERy1zbWkukPMQCPrxmJNSJVxWsE7Wkwg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787778533&P2=404&P3=2&P4=lOHwZWqJeamGeYvkgbu2QoKOrSo4O8gfkqX5MMuaPLb6LBJpnnRmf32fHogyI7Qu9OnpZPJo2ZRCfwwayFfGdw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
23.40.52.209
23.11.37.157

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 226dfb3bbc3ed370bc4a17c877c690607b87d6c1b5717c6b9a224410638efd90
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\75d267eeab42fa15fc0a764fd601caff.png - 539a19473ca2bf70aa423f47efccbf501916536be9928edb7789640d5996a65e
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://cctraff.ru/strik?keyword=becoming+supernatural+joe+dispenza+ebook
https://cdn.shopify.com/s/files/1/0440/5723/1525/files/71609730083.pdf
https://cdn.shopify.com/s/files/1/0436/2692/2147/files/nesopina.pdf
https://cdn.shopify.com/s/files/1/0483/4689/0393/files/solving_systems_by_elimination_worksheet_5-3.pdf
https://cdn.shopify.com/s/files/1/0433/6350/0197/files/alif_the_unseen_summary.pdf
https://cdn.shopify.com/s/files/1/0484/2969/5133/files/monroes_motivated_sequence_example.pdf
http://jutimok.karanbershaw.com/uploads/1/3/2/7/132740541/matenaxenosivibesi.pdf
http://files.therosados.org/uploads/1/3/1/3/131384127/raxul.pdf
http://josovod.moderndaysolution.com/uploads/1/3/2/7/132740249/5030286.pdf
http://files.greenleafpsychological.com/uploads/1/3/2/3/132302892/durejanilafuf-nobixu-xusowu-vibowat.pdf
http://files.myyogatribu.com/uploads/1/3/1/4/131438510/miporiberokuba.pdf
http://files.peakhealthcaremaryland.com/uploads/1/3/1/4/131406816/rizapisopasiraluzoga.pdf
http://files.coinsmakecents.com/uploads/1/3/1/8/131856212/7492386.pdf
http://vugasenuj.morningswithamissionary.com/uploads/1/3/2/6/132683218/gemis.pdf
https://site-1036894.mozfiles.com/files/1036894/vilinumab.pdf
https://site-1036728.mozfiles.com/files/1036728/50864133456.pdf
https://site-1037029.mozfiles.com/files/1037029/megofovujapipi.pdf
https://site-1037187.mozfiles.com/files/1037187/pivusobadafukudowafopam.pdf
https://site-1036941.mozfiles.com/files/1036941/domisijoleroninula.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

cctraff.ru
cdn.shopify.com
jutimok.karanbershaw.com
files.therosados.org
josovod.moderndaysolution.com
files.greenleafpsychological.com
files.myyogatribu.com
files.peakhealthcaremaryland.com
files.coinsmakecents.com
vugasenuj.morningswithamissionary.com
site-1036894.mozfiles.com
site-1036728.mozfiles.com
site-1037029.mozfiles.com
site-1037187.mozfiles.com
site-1036941.mozfiles.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

52.110.12.14
20.247.184.142
4.230.171.124
135.233.95.144
4.150.223.107
20.236.44.162
52.123.128.14
74.179.77.204
52.123.252.236
72.153.5.139
203.26.79.13
52.123.252.247
48.211.4.16
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report