MALICIOUS — 93c935_018a8668c6b84eb8ba18d85885283fe6.pdf
MALICIOUS — 93c935_018a8668c6b84eb8ba18d85885283fe6.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 3 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
6f962e064079101da8d947b37bfb29a7541f9e22c8c84ab7e486674aed74f1bf - SHA-1:
c41e73170f217c4593f4b0f0642af53b28bbb83c - MD5:
66fd1407e33d27863c4990b18f5a0982 - ssdeep:
768:iwgGzpDxneHMIKkXL+YCxzm1rX/mNQpYM+aRHKGAWweV69E:GGFlnCL+vzkXqQCoRH/AHY69E - TLSH:
T11D307BF314D7EC8C6D87AB53ADA611912188D7896137EB6068DC776CD87C1BDAF00860 - Submitted as: 93c935_018a8668c6b84eb8ba18d85885283fe6.pdf
- File type: pdf · Size: 36831 bytes
- Verdict: malicious (92/100)
Detections (3 of 54 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 92/100 is the fusion of 8 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - Contacted 12 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ttraff.club/wix?keyword=tissot+1853+tachymeter+manual, https://47948147-9b2b-40c9-a8c2-bb427d678c4f.filesusr.com/ugd/7be1cd_efeca0470ec94dca86bd2a08e29ee2e5.pdf?index=true, https://98054f9e-9699-445a-9722-0f1db1be1d0b.filesusr.com/ugd/d61b30_9ae1697c1966472580a0c7cb983ceac3.pdf?index=true - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
1200 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- teams.cloud.microsoft
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- outlook.office.com
- ntp.ubuntu.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://c.pki.goog/r/r1.crl
- http://x2.c.lencr.org/
- http://ye.c.lencr.org/
- http://yr.c.lencr.org/
- 23.40.52.209
- 23.11.37.157
Dropped files
- root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://ttraff.club/wix?keyword=tissot+1853+tachymeter+manual
- https://47948147-9b2b-40c9-a8c2-bb427d678c4f.filesusr.com/ugd/7be1cd_efeca0470ec94dca86bd2a08e29ee2e5.pdf?index=true
- https://98054f9e-9699-445a-9722-0f1db1be1d0b.filesusr.com/ugd/d61b30_9ae1697c1966472580a0c7cb983ceac3.pdf?index=true
- https://099bc257-2eeb-4ba5-a56b-66c72a975a26.filesusr.com/ugd/9d869b_e524c888db84464da3413028b0702a38.pdf?index=true
- https://3fd451b7-7ee2-4806-8fa3-b6dff7d1f608.filesusr.com/ugd/011e4b_cbc34c7f714a45f199a6440867a68d0c.pdf?index=true
- https://ee266eaf-422d-48dc-be6d-9ffd4744f7ad.filesusr.com/ugd/c57cae_8ae9156c61c94b8197a74a2b82f8d7df.pdf?index=true
- https://cdn.shopify.com/s/files/1/0432/5815/1072/files/auxilio_judicial_temario_gratis.pdf
- https://cdn.shopify.com/s/files/1/0448/0362/1025/files/nesujibinelivo.pdf
- https://cdn.shopify.com/s/files/1/0453/3213/6091/files/biology_notes_for_neet_2020.pdf
- https://cdn.shopify.com/s/files/1/0430/0803/2922/files/brian_tracy_no_excuses_summary.pdf
- https://cdn.shopify.com/s/files/1/0429/2860/3295/files/aladdin_game_sega_free.pdf
- http://vebodo.tarrantfatherhood.com/uploads/1/3/1/8/131856072/29a8aed1605b.pdf
- http://xilixolon.welcomesociety.org/uploads/1/3/1/4/131407588/70761.pdf
- http://wixaziki.healthandculture.net/uploads/1/3/1/0/131069839/85382a5486.pdf
- https://cc7ff327-f1d2-4254-ab37-acc3f0e976d7.filesusr.com/ugd/ac8c68_caed681ba82c4940b38a51723fc67a91.pdf?index=true
- https://23c6e5a5-d0da-4185-b800-a59825db5807.filesusr.com/ugd/565485_2daa4fe856104bf0b50fad835ebfcf5c.pdf?index=true
- https://8ef7b55c-c838-4e7a-834c-7dee87c45085.filesusr.com/ugd/77941b_b9bcef70b5cc479fa4d4169af3438e0e.pdf?index=true
- https://8d94b0a8-b82f-42e1-b594-d2315a26aa50.filesusr.com/ugd/29c71c_49d5a9c3338d4b62ae9720d16424fc66.pdf?index=true
- https://80c73fdf-e194-42d8-b2ca-f830b9fecee9.filesusr.com/ugd/c5d40f_017abec0bd7f4af8bc71ca29d5b9b5e2.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ttraff.club
- 47948147-9b2b-40c9-a8c2-bb427d678c4f.filesusr.com
- 98054f9e-9699-445a-9722-0f1db1be1d0b.filesusr.com
- 099bc257-2eeb-4ba5-a56b-66c72a975a26.filesusr.com
- 3fd451b7-7ee2-4806-8fa3-b6dff7d1f608.filesusr.com
- ee266eaf-422d-48dc-be6d-9ffd4744f7ad.filesusr.com
- cdn.shopify.com
- vebodo.tarrantfatherhood.com
- xilixolon.welcomesociety.org
- wixaziki.healthandculture.net
- cc7ff327-f1d2-4254-ab37-acc3f0e976d7.filesusr.com
- 23c6e5a5-d0da-4185-b800-a59825db5807.filesusr.com
- 8ef7b55c-c838-4e7a-834c-7dee87c45085.filesusr.com
- 8d94b0a8-b82f-42e1-b594-d2315a26aa50.filesusr.com
- 80c73fdf-e194-42d8-b2ca-f830b9fecee9.filesusr.com
- www.w3.org
- purl.org
- ns.adobe.com
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 34.104.35.123
- 52.123.252.215
- 172.64.154.167
- 52.123.252.245
- 52.123.129.14
- 20.42.179.192
- 172.215.188.232
- 4.230.171.124
- 52.123.128.14
- 52.182.143.212
- 162.159.36.2
- 20.165.94.46
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report