MALICIOUS — 90379176904.pdf

MALICIOUS — 90379176904.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (86/100). 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 73d4c2615ca91ae8eccc9d465d895bf2bbb04ccb6d0bcc14558b7d4d30bd9930
SHA-1: e37df23049abd1df930e799328709ef13dbd858a
MD5: efb67f2d0f97f61fbd17e50ccc3a4608
ssdeep: 768:4gGzpDV2intL+9A2c8Lrcplh4S1RRIbXzfqgFx3qnQZf/TqA5RPOT29:VGFh2qL+amLrczh5RR+jq09qQN/TqGGY
TLSH: T1D8329EF311A7EC8CB6866B036DEB1559A049D68C7132D7A04888767DC4B83FD6E40970
Submitted as: 90379176904.pdf
File type: pdf · Size: 46224 bytes
Verdict: malicious (86/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 86/100 is the fusion of 7 weighted signals:

Memory forensics: 4 finding(s), e.g. RWX/private injected region in SumatraPDF.exe (pid 2676) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Contacted 26 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/c21ad7bf-30f3-428f-91cd-3920e4e71325/pobivagizidejumuxig.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://cctraff.ru/strik?keyword=gerunds+participles+and+infinitives, http://files.rvadventuresutah.com/uploads/1/3/2/6/132696113/b54ff1c.pdf, http://files.ugroup-trade.com/uploads/1/3/0/7/130739028/gutejorosovejiwamig.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (15 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9629 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
250.255.255.239.in-addr.arpa
desktop-hsgcbep
ntp.ubuntu.com
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\bcc62bc12a4d8febb80b6b7953808b2b.png - 8ed9ce3b0a479ccae01f21178d80d0f7fe82426864c8843a191f7599cacc3d3f
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 63869a78191f7c03da7228361b4e440055dc8ab7f92b32f4dd88fcfaebb7c241
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://cctraff.ru/strik?keyword=gerunds+participles+and+infinitives
http://files.rvadventuresutah.com/uploads/1/3/2/6/132696113/b54ff1c.pdf
http://files.ugroup-trade.com/uploads/1/3/0/7/130739028/gutejorosovejiwamig.pdf
http://files.vantagepointchiro.com/uploads/1/3/1/3/131382491/nafajelitejesesuki.pdf
https://site-1039797.mozfiles.com/files/1039797/lapefupikanevofubawovebal.pdf
https://site-1036742.mozfiles.com/files/1036742/34074702284.pdf
https://site-1038920.mozfiles.com/files/1038920/lejanisetopetom.pdf
https://uploads.strikinglycdn.com/files/c21ad7bf-30f3-428f-91cd-3920e4e71325/pobivagizidejumuxig.pdf
https://uploads.strikinglycdn.com/files/f5b183d6-fc94-4917-97f6-a0d7231abb29/36622261514.pdf
https://uploads.strikinglycdn.com/files/cbb1f7aa-e288-4feb-8b59-1386d99e680d/jijofekogabezatudigojo.pdf
https://uploads.strikinglycdn.com/files/823957e9-1de5-4e70-8572-de7e1b6886de/87773676980.pdf
https://uploads.strikinglycdn.com/files/e9635e6d-48e2-4dae-9704-2419b7724f65/xuwokavuwumilelesafu.pdf
http://bifejid.donnariverafurniture.com/uploads/1/3/1/1/131164312/7296531.pdf
http://files.austinburgfirstucc.org/uploads/1/3/2/6/132681460/rosutenorin.pdf
http://nebuxoli.electaylin.com/uploads/1/3/2/6/132683292/3325241.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

cctraff.ru
files.rvadventuresutah.com
files.ugroup-trade.com
files.vantagepointchiro.com
site-1039797.mozfiles.com
site-1036742.mozfiles.com
site-1038920.mozfiles.com
uploads.strikinglycdn.com
bifejid.donnariverafurniture.com
files.austinburgfirstucc.org
nebuxoli.electaylin.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

51.104.15.253
4.150.223.106
20.42.73.30
52.123.252.245
74.179.71.159
52.123.128.14
172.215.188.232
172.66.2.5
74.178.232.29
52.110.12.16
4.230.171.124
20.3.1.41
203.26.79.13
135.232.92.97
135.233.95.144
20.76.201.171
20.184.175.20
40.99.133.210
74.178.76.44
92.223.78.30
57.154.63.210
135.233.45.222
48.199.12.1
20.184.175.6
20.184.175.7

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report