SUSPICIOUS — minazud_nitupafelu_tifowat.pdf
SUSPICIOUS — minazud_nitupafelu_tifowat.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (66/100). 2 of 50 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
7a5e4d36f10d784a1256910dbd8ff80513b601f7646b7037b07b3edd26e36d73 - SHA-1:
6b95a0d96855b71c081d3dc1c42ec972ae4bcca8 - MD5:
80ce5be4db4a8e83f61a9ad725a037b7 - ssdeep:
1536:rGFvpsdyLpvddEjXRBxyXyPo+o1lbS8iPQUvlpSdrwZUndzAHST6:KFvps+vMX0D+OlbS8ioUdpWrwUndAh - TLSH:
T1D837BFF35097DD8CBE87AB83AE761699A44EC78871279B50448CF72DC4BC1AD6F40811 - Submitted as: minazud_nitupafelu_tifowat.pdf
- File type: pdf · Size: 69905 bytes
- Verdict: suspicious (66/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 66/100 is the fusion of 7 weighted signals:
- Embedded link rated suspicious by URL analysis: https://finiluxexolije.weebly.com/uploads/1/3/1/8/131856594/nebomenoloxatum.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=elite%20dangerous%20aufkl%C3%A4rungsscanner, https://uploads.strikinglycdn.com/files/39178d78-591e-43f6-b956-125d60142062/40482959692.pdf, https://uploads.strikinglycdn.com/files/9e55395f-2732-4ec2-8745-3b149088cf7f/4256699094.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Contacted 10 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
9923 behavior events · 1 ATT&CK techniques · 3 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- searchapp.bundleassets.example
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- desktop-hsgcbep
- desktop-hsgcbep._dosvc._tcp.local
- 255.255.254.169.in-addr.arpa
- 79.243.254.169.in-addr.arpa
- 250.255.255.239.in-addr.arpa
- ntp.ubuntu.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
Dropped files
- C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\11a4c5bf0881fd29bb0a40b57ba96de0.png -
c3d46ff20d6efe35331d4855f9a3ffb09ece2fa1d6c132d801cdbeb89d20f6c0 - C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt -
f73c75f854731b65d665ed0c46c4c4565b3abc79029b436406477f400884e500 - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://cctraff.ru/wb?keyword=elite%20dangerous%20aufkl%C3%A4rungsscanner
- https://uploads.strikinglycdn.com/files/39178d78-591e-43f6-b956-125d60142062/40482959692.pdf
- https://uploads.strikinglycdn.com/files/9e55395f-2732-4ec2-8745-3b149088cf7f/4256699094.pdf
- https://uploads.strikinglycdn.com/files/1279669b-2654-46a4-b810-e48661634633/67916978075.pdf
- https://uploads.strikinglycdn.com/files/93a238ca-0df5-4d06-8e48-25ef8f867f58/papawajaxetepekefedavixe.pdf
- https://finiluxexolije.weebly.com/uploads/1/3/1/8/131856594/nebomenoloxatum.pdf
- https://fevixivosetakub.weebly.com/uploads/1/3/2/6/132681861/sidojeloxe_zatonimexawigup.pdf
- https://vuzevarezevarot.weebly.com/uploads/1/3/0/7/130740461/dokufijaf.pdf
- https://cdn-cms.f-static.net/uploads/4368736/normal_5f87c49222735.pdf
- https://cdn-cms.f-static.net/uploads/4369317/normal_5f894af7c8b4e.pdf
- https://cdn-cms.f-static.net/uploads/4366984/normal_5f879a38f030f.pdf
- https://cdn-cms.f-static.net/uploads/4365998/normal_5f88f79c911b1.pdf
- https://cdn-cms.f-static.net/uploads/4366625/normal_5f88bc0615778.pdf
- https://cdn-cms.f-static.net/uploads/4369928/normal_5f87ecd7d5f47.pdf
- https://cdn-cms.f-static.net/uploads/4367289/normal_5f87416d10c80.pdf
- https://cdn-cms.f-static.net/uploads/4366668/normal_5f872e7b21dec.pdf
- https://cdn-cms.f-static.net/uploads/4368751/normal_5f8935e550963.pdf
- https://uploads.strikinglycdn.com/files/a55c9845-4df7-49ef-b59f-49d126d42e4b/76923645080.pdf
- https://uploads.strikinglycdn.com/files/61b79c9b-c68d-49cb-a6bc-ddd8f0794f56/risugejenajavakijok.pdf
- https://uploads.strikinglycdn.com/files/4290f62a-56bd-497d-b032-d8a589977f12/62928853497.pdf
- https://uploads.strikinglycdn.com/files/0fcbf75e-621b-40c4-8bfc-7243b4600739/92464734976.pdf
- https://uploads.strikinglycdn.com/files/a7d01894-c81d-42de-80e7-25e37a46ee4d/74511427280.pdf
- https://uploads.strikinglycdn.com/files/fa22d60f-02d5-4aca-911e-a69b4d693108/51864203047.pdf
- https://uploads.strikinglycdn.com/files/ee726bdb-20a8-47b6-b2ad-1e55aff6d264/39102907268.pdf
- https://uploads.strikinglycdn.com/files/d41d124e-a34e-4117-a45a-cd80a44c76dc/jinifepatome.pdf
Embedded domains
- cctraff.ru
- uploads.strikinglycdn.com
- finiluxexolije.weebly.com
- fevixivosetakub.weebly.com
- vuzevarezevarot.weebly.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Embedded IP addresses
- 51.104.15.253
- 4.230.171.124
- 57.154.63.210
- 135.233.95.135
- 4.150.223.110
- 20.165.94.63
- 4.150.223.104
- 74.178.232.29
- 52.123.129.14
- 72.145.35.100
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report