MALICIOUS — normal_5fab7301e3c2b.pdf

MALICIOUS — normal_5fab7301e3c2b.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 5e4ae5e2f8ec08140272c114d77f3b35844255ae9cc829319c7097d76325c4c7
SHA-1: 1b43cdaba643f3f9d9df75566bcd7d862b2fcc85
MD5: 0a608320adcbfd37554dd0ef106120cd
ssdeep: 1536:d375UobBBVBB5TWk1ZKno/f6BBSoM3JazIpcbnFXyC2er908aZ:d5D1P5tqoQSoGJwas32er90X
TLSH: T1C637E1F7D1ABEE887B525B532A720559654ACA892037C2B01144FBBCC9EC7FCAC00965
Submitted as: normal_5fab7301e3c2b.pdf
File type: pdf · Size: 71423 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Contacted 19 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/245a6aa3-9375-48de-a756-23d116a4a53b/32997079309.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://trafffi.ru/123?keyword=how+to+quote+an+article+online, https://bupiwuzisulim.weebly.com/uploads/1/3/0/8/130874125/mokoxibobunatu-nasimifisogivu.pdf, https://uploads.strikinglycdn.com/files/80aba5e9-606b-4cea-8967-716d1e52671b/fuwixutajujatapopadik.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9799 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
desktop-hsgcbep
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\a029b7244fde4e2931720174529c9913.png - 54e38ddaa06febf89dd05d403720b30fe58b568e8d01d58b90dda7b31564a463
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 409d7512cef11562c87e9299162259b1dcc02091fba1552f9f44caf40b1db7f0
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://trafffi.ru/123?keyword=how+to+quote+an+article+online
https://bupiwuzisulim.weebly.com/uploads/1/3/0/8/130874125/mokoxibobunatu-nasimifisogivu.pdf
https://uploads.strikinglycdn.com/files/80aba5e9-606b-4cea-8967-716d1e52671b/fuwixutajujatapopadik.pdf
https://sozivutapadonen.weebly.com/uploads/1/3/1/1/131164462/gikinigudatubelag.pdf
https://bapadiwifujeki.weebly.com/uploads/1/3/4/0/134041393/ziken.pdf
https://s3.amazonaws.com/wizidimawag/3892118016.pdf
https://todoxaladavefuk.weebly.com/uploads/1/3/4/5/134529573/fba19f64.pdf
https://uploads.strikinglycdn.com/files/245a6aa3-9375-48de-a756-23d116a4a53b/32997079309.pdf
https://pajedurozibije.weebly.com/uploads/1/3/4/4/134446399/gabatofetobivoja.pdf
https://naxesitigas.weebly.com/uploads/1/3/0/7/130740165/sugaminifesurabuni.pdf
https://mupibidegupek.weebly.com/uploads/1/3/0/8/130874042/pofuvejesipixu.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787745953&P2=404&P3=2&P4=egQ826gj18CNWtGClssTzGnM4sMiqS6RHfo09iZgCAXiGka7dEMq7qK98eg9aXbGwvVEg0OLbZpDh5dK%2bFp6pw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787746015&P2=404&P3=2&P4=dTjEWvKU91JYHqFp6Jo%2bLvCtjtKtwNcnWKrSsIaPHI7kqNVLHO9q91e7kKd2y3T8MveKqYPz3QdjgS4amYTTwQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl

Embedded domains

trafffi.ru
bupiwuzisulim.weebly.com
uploads.strikinglycdn.com
sozivutapadonen.weebly.com
bapadiwifujeki.weebly.com
s3.amazonaws.com
todoxaladavefuk.weebly.com
pajedurozibije.weebly.com
naxesitigas.weebly.com
mupibidegupek.weebly.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

52.148.114.188
172.172.255.218
48.211.4.16
52.123.252.233
52.110.12.8
52.110.12.47
57.154.63.210
4.230.171.124
20.184.175.20
135.233.95.144
52.123.128.14
172.215.188.225
135.233.45.223
74.179.71.159
203.26.79.13
52.123.252.242
172.66.2.5
51.104.15.252
142.250.183.35

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report