MALICIOUS — normal_5fdf595fc80cb.pdf

MALICIOUS — normal_5fdf595fc80cb.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100). 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 6385f379e84d5657ff8fac063b06145e3301a0f11a93dc236e4b5ad0735d0793
SHA-1: ebcd8782e2f1834d03e0a04484533fef7bc47c85
MD5: 238548bd99f9c98a4a3ef0b83ef51814
ssdeep: 1536:q3PPPMBykvlITjleZh5Y421HeGyNmz0jukbJorb5r3YKe20owxb4Wyb4:qP3M/IXIZrqbeukWcKeCwbF
TLSH: T1B436D0F7B19FEC0C36625B136DE75458B8AAD7447236ABA044C87B2CC47C29E7E11860
Submitted as: normal_5fdf595fc80cb.pdf
File type: pdf · Size: 69538 bytes
Verdict: malicious (84/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 84/100 is the fusion of 6 weighted signals:

Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4453142/normal_5fcedbf07b181.pdf - network signal, weight 0.70, confidence 0.80
Contacted 18 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://traffset.ru/123?utm_term=tamera+mowry+net+worth, https://cdn-cms.f-static.net/uploads/4383470/normal_5fc21ddb82dee.pdf, https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe00cae18c5c478ec2253d/1606287562142/veryfitpro_user_manual.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (5 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9681 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
ntp.ubuntu.com
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - cdfa5e0a6f0f2a09c3556b74e3e39b1ec11fbfd3f24fa50babeee08f9b4d031e
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\724751d97cedcc897bf7338461e632f2.png - 4b9e230996b2fdee0bed2fc7f1f1a3159737fc1bdfe5382ced07316664845e0e
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://traffset.ru/123?utm_term=tamera+mowry+net+worth
https://cdn-cms.f-static.net/uploads/4383470/normal_5fc21ddb82dee.pdf
https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe00cae18c5c478ec2253d/1606287562142/veryfitpro_user_manual.pdf
https://zugozoriv.weebly.com/uploads/1/3/4/7/134770463/sumoxufoxudapeti.pdf
https://pafovawulawagi.weebly.com/uploads/1/3/4/5/134581771/verusamado-jokivilovol-xidefu.pdf
https://static1.squarespace.com/static/5fc4e55a8139af03765eb36e/t/5fcba78f36758319a5578b9a/1607182223298/sniper_gang_slides_amazon.pdf
https://pikupazu.weebly.com/uploads/1/3/4/5/134577858/monoleji-dirozimi-sotusefejep-texerake.pdf
https://tedawubav.weebly.com/uploads/1/3/4/3/134376018/6fcd874d5401a.pdf
https://kizofupotumi.weebly.com/uploads/1/3/4/3/134314367/guraxip.pdf
https://static1.squarespace.com/static/5fc542159955c744b5580f48/t/5fc71c17a3696915e21df93a/1606884375357/time_to_get_to_mars_and_back.pdf
https://static.s123-cdn-static.com/uploads/4453142/normal_5fcedbf07b181.pdf
https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf4b853570fb44d1f8f495/1606372237008/minomilupebode.pdf
https://uploads.strikinglycdn.com/files/d6c77adb-f1db-45c1-9edb-e0384269ffef/girolokuwovopome.pdf
https://uploads.strikinglycdn.com/files/14cb83dd-73d5-4ba0-82de-f75d1394b283/46811372042.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787732399&P2=404&P3=2&P4=NJBPJl8iTlTPOIbF%2fXhkhiXDIk3YK85iwGBTVqUqfayaIzKDsGA96gwSUF9w3xg3NCzLNYzM7T2KvxxKMsoQYQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

traffset.ru
cdn-cms.f-static.net
static1.squarespace.com
zugozoriv.weebly.com
pafovawulawagi.weebly.com
pikupazu.weebly.com
tedawubav.weebly.com
kizofupotumi.weebly.com
static.s123-cdn-static.com
uploads.strikinglycdn.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

172.172.255.218
4.247.188.224
52.123.252.220
52.123.252.230
74.178.76.44
4.230.171.124
20.247.185.124
74.178.76.128
40.84.97.4
203.26.79.13
20.236.44.162
20.42.65.94
52.123.129.14
40.99.133.242
92.223.78.30
135.234.160.244
142.250.183.35
20.184.175.15

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report