MALICIOUS — normal_5f8b982a9be32.pdf
MALICIOUS — normal_5f8b982a9be32.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (72/100). 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
6dc58b1a340a293c340245b8b596fbc170418eb7dd660955316cfa557d015b89 - SHA-1:
f1445b486f29ec6cd201d129dc52984e6c17c9e3 - MD5:
a5e3f77e795563c4a225b46527d7187a - ssdeep:
768:9gGzpDep9YtJu6lTrTuXrZdWfRnKnuBh3aSu6OWmWVpJypwecCOyTVXABICQXiiq:+GFip9F4nLBASuBbCs3nlVwfiwj5 - TLSH:
T1BB318DF760A7DE4C7A8B9B13ADAA1169208ED7882137975044C8372CD4FC6BC3F519A0 - Submitted as: normal_5f8b982a9be32.pdf
- File type: pdf · Size: 43163 bytes
- Verdict: malicious (72/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 72/100 is the fusion of 6 weighted signals:
- Contacted 23 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/403e39ab-589c-4691-a01d-a5548f127b9a/vepomexajamonekotewafux.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://ttraff.club/123?keyword=protimeter+digital+mini+instructions, https://uploads.strikinglycdn.com/files/403e39ab-589c-4691-a01d-a5548f127b9a/vepomexajamonekotewafux.pdf, https://uploads.strikinglycdn.com/files/a0b10931-5b19-41d0-a96b-7c80aa63cfc7/96901525604.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Extracted generic config (17 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
9716 behavior events · 0 ATT&CK techniques · 3 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- desktop-hsgcbep
- 250.255.255.239.in-addr.arpa
- ntp.ubuntu.com
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Dropped files
- C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt -
0fc5622e7ff8f4af27da547fb3b8c640f3452ea73be545f94037238ceb5387b4 - C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\8b83ffb019169989a91bffd4faef348a.png -
e5fa882951a0d4317afce09053ba9c0b0e2179de4aad37167014eb3fcb3c9054 - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://ttraff.club/123?keyword=protimeter+digital+mini+instructions
- https://uploads.strikinglycdn.com/files/403e39ab-589c-4691-a01d-a5548f127b9a/vepomexajamonekotewafux.pdf
- https://uploads.strikinglycdn.com/files/a0b10931-5b19-41d0-a96b-7c80aa63cfc7/96901525604.pdf
- https://uploads.strikinglycdn.com/files/eb464304-5e32-47ba-9179-c46a747452e9/xufoxafukawofe.pdf
- https://cdn-cms.f-static.net/uploads/4366306/normal_5f8b7b125f56a.pdf
- https://cdn-cms.f-static.net/uploads/4369491/normal_5f8b6ec75e45f.pdf
- https://cdn-cms.f-static.net/uploads/4370066/normal_5f8a5e859c9f0.pdf
- https://cdn-cms.f-static.net/uploads/4369149/normal_5f8b919c0e2f6.pdf
- https://cdn-cms.f-static.net/uploads/4369657/normal_5f87e6b120f60.pdf
- https://cdn-cms.f-static.net/uploads/4370299/normal_5f8aa6e68d5d7.pdf
- https://cdn-cms.f-static.net/uploads/4381738/normal_5f8b74f3a7a0f.pdf
- https://cdn-cms.f-static.net/uploads/4365639/normal_5f87070b2b7d1.pdf
- https://cdn-cms.f-static.net/uploads/4374185/normal_5f89c8c7bb9bd.pdf
- https://cdn.shopify.com/s/files/1/0480/8245/2644/files/cook_middle_school_phone_number.pdf
- https://cdn.shopify.com/s/files/1/0499/1388/8936/files/61881407405.pdf
- https://cdn.shopify.com/s/files/1/0483/7130/2553/files/preguntas_sin_respuesta_tontas.pdf
- https://cdn-cms.f-static.net/uploads/4367279/normal_5f88d2c7dca1c.pdf
- https://cdn-cms.f-static.net/uploads/4367299/normal_5f8b90147e21c.pdf
- https://uploads.strikinglycdn.com/files/75fb5ba6-007e-4c2e-a789-42e82eac30b9/jujefivezikiledokatisuv.pdf
- https://uploads.strikinglycdn.com/files/c45b5f22-dd84-4f8b-9b1e-6516aa73f722/69123453688.pdf
- https://uploads.strikinglycdn.com/files/c0effbb5-63d3-4258-a686-c6a0d39fb110/56300480899.pdf
- https://uploads.strikinglycdn.com/files/2e88fc01-05d3-4b15-903d-9f7b0ccdc50d/nimorulapi.pdf
- https://uploads.strikinglycdn.com/files/a4463bf1-70bd-45fa-b9a6-73f33c142d7e/24380890149.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- ttraff.club
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Embedded IP addresses
- 20.42.65.93
- 172.172.255.217
- 4.247.188.233
- 20.184.175.12
- 172.215.188.232
- 162.159.142.9
- 20.184.175.2
- 4.247.188.224
- 52.110.12.56
- 4.230.171.124
- 20.247.185.124
- 20.42.73.28
- 20.76.201.171
- 74.178.240.61
- 52.123.128.14
- 40.99.133.226
- 72.153.5.129
- 203.26.79.13
- 172.178.240.161
- 52.123.252.236
- 74.178.76.44
- 135.234.160.245
- 74.178.232.29
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report