MALICIOUS — normal_5f8bf3630c294.pdf
MALICIOUS — normal_5f8bf3630c294.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100). 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
715057e1330d6031309af69ead86c085b0e5310932d4f4025813bb94a828b815 - SHA-1:
fa320646816c68a74a873b82db8eca5b34c95922 - MD5:
a536b188c775fb331e3f9e2be8d57a7b - ssdeep:
768:ogGzpDGp4Mqgi01qL5+imjlA28oGi4EFf5EMpuB056rhKPqYNuSWrEs/lQ8wdtc4:lGFapzwvhOqiWrEilQ8wdtc4 - TLSH:
T125329DF360A7EC4D3A87AB13B9EB156E548AD74861739721488C672DC07C6BE3F11920 - Submitted as: normal_5f8bf3630c294.pdf
- File type: pdf · Size: 47139 bytes
- Verdict: malicious (84/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 84/100 is the fusion of 6 weighted signals:
- Embedded link rated malicious by URL analysis: https://cdn-cms.f-static.net/uploads/4366031/normal_5f871c452289f.pdf - network signal, weight 0.70, confidence 0.80
- Contacted 19 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://ttraff.cc/123?keyword=context+clues+worksheets+grade+9, https://cdn-cms.f-static.net/uploads/4366340/normal_5f87620d4a4ea.pdf, https://cdn-cms.f-static.net/uploads/4365652/normal_5f86fc9d65972.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
9712 behavior events · 0 ATT&CK techniques · 3 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- desktop-hsgcbep
- ntp.ubuntu.com
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 250.255.255.239.in-addr.arpa
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 255.255.254.169.in-addr.arpa
- 79.243.254.169.in-addr.arpa
- http://www.msftconnecttest.com/connecttest.txt
Dropped files
- C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\58db3ea696909ee09dede78daee7f462.png -
b3715c0b5df62fd5778b3683f3102380b5135f5e492be037095c100c3285ff42 - C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt -
d9655693efceaf4ab634e105abe001b92f6f8901a90c9d1ba817f69fdc0d7fa4 - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://ttraff.cc/123?keyword=context+clues+worksheets+grade+9
- https://cdn-cms.f-static.net/uploads/4366340/normal_5f87620d4a4ea.pdf
- https://cdn-cms.f-static.net/uploads/4365652/normal_5f86fc9d65972.pdf
- https://cdn-cms.f-static.net/uploads/4381752/normal_5f8b602c77483.pdf
- https://cdn-cms.f-static.net/uploads/4369520/normal_5f88313cbbe33.pdf
- https://cdn-cms.f-static.net/uploads/4366031/normal_5f871c452289f.pdf
- https://cdn-cms.f-static.net/uploads/4370268/normal_5f8bd7557fa02.pdf
- https://cdn-cms.f-static.net/uploads/4366341/normal_5f879d57b62b2.pdf
- https://cdn-cms.f-static.net/uploads/4374700/normal_5f89a4173b8d7.pdf
- https://uploads.strikinglycdn.com/files/5022a2f8-4448-4c92-a11d-349eb3ee03a8/25985937979.pdf
- https://uploads.strikinglycdn.com/files/d8391962-32e1-42a5-ac92-c05be3610f83/35289963316.pdf
- https://uploads.strikinglycdn.com/files/88290b0d-a74a-4f55-859c-e490e8e66356/fowabulevoviza.pdf
- https://uploads.strikinglycdn.com/files/26f8a9df-afe0-4463-856b-e5b70ff84ead/godizuwosofazirukopatiga.pdf
- https://cdn.shopify.com/s/files/1/0485/2370/6523/files/crystal_radio_kit_amazon.pdf
- https://cdn.shopify.com/s/files/1/0469/9596/4056/files/something_the_lord_made_worksheet_answers.pdf
- https://cdn.shopify.com/s/files/1/0498/0647/5421/files/97599659434.pdf
- https://cdn.shopify.com/s/files/1/0482/3180/9176/files/is_editor_in_chief_hyphenated.pdf
- https://cdn-cms.f-static.net/uploads/4368758/normal_5f8a576aee48c.pdf
- https://cdn-cms.f-static.net/uploads/4369771/normal_5f87d79d40ad4.pdf
- https://cdn-cms.f-static.net/uploads/4366359/normal_5f8a73eca5733.pdf
- https://cdn-cms.f-static.net/uploads/4369802/normal_5f8841d640a67.pdf
- https://cdn-cms.f-static.net/uploads/4365570/normal_5f870a24bab43.pdf
- https://cdn.shopify.com/s/files/1/0483/0799/4788/files/clear_clip_tray_android.pdf
- https://cdn.shopify.com/s/files/1/0498/1889/4491/files/yankee_doodle_dixie.pdf
- https://cdn.shopify.com/s/files/1/0497/4837/7754/files/megumulitipajog.pdf
Embedded domains
- ttraff.cc
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Embedded IP addresses
- 172.172.255.218
- 52.110.12.28
- 52.110.12.49
- 20.42.179.192
- 4.230.171.124
- 74.178.240.61
- 135.232.92.97
- 52.123.128.14
- 52.123.129.14
- 4.150.223.106
- 72.145.35.106
- 203.26.79.13
- 20.42.65.89
- 92.223.78.30
- 40.84.85.40
- 20.42.73.26
- 48.211.4.16
- 20.184.175.15
- 74.178.76.44
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report