MALICIOUS — toramijodekuwile.pdf

MALICIOUS — toramijodekuwile.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100). 2 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 7b31b7cf88786f65d5cbe6ee48ab06cf05c784f14c41f2c85eba357a4498d481
SHA-1: d4a197e196304b702f7b43a26c90a8c1066111a9
MD5: 69f97e776189ee82af2da8563065462f
ssdeep: 3072:uF9tbH6vXqk2aBQQ5gSxeNUA1YTZnlVPDuFsl2:+/OX35zeN71WlQsl2
TLSH: T1423BE0F3509BDC4836976787AEA31521218AC3883675D760888DB7ADC0B87FDBF10A51
Submitted as: toramijodekuwile.pdf
File type: pdf · Size: 102727 bytes
Verdict: malicious (84/100)

Detections (2 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1

MITRE ATT&CK

Why this verdict

The malicious score of 84/100 is the fusion of 6 weighted signals:

Embedded link rated malicious by URL analysis: https://uploads.strikinglycdn.com/files/277a133b-cc5e-4b09-9682-e24298f45efa/fedokigojeremiri.pdf - network signal, weight 0.70, confidence 0.80
Contacted 19 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://ggtraff.ru/strik?keyword=estructura+organizativa+tesco+plc+lo, https://uploads.strikinglycdn.com/files/dd5f0e33-ce9a-4944-875c-3668f383af43/bitasalipisisakujizi.pdf, https://uploads.strikinglycdn.com/files/6698202f-8868-40f7-94c6-c34aca784ac5/bazegelipuwisarezatu.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9721 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787764967&P2=404&P3=2&P4=d0DZ6o186HS4pG273Mptu0lRsk44plaAeZXdgZDcFVeH%2b1X9%2fXCOqU4GwqeGwOKUi2OURyzMGZnIyeIpQvKL4g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787764992&P2=404&P3=2&P4=hsTZLwd3Oaw%2b2NrF%2fxoPdDiufoTY11ENbBJ7CVFI9YLvi6H3lZSC%2fBYm2o6%2bXUEjiJnswIFS1N36CkaYIlCzrw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\6aad4380b1421733b4e2ab74bc0f1022.png - 561d1aa36ff28612f791f617322b2ef6c0bb065b2836fdcba321076088cbd0c4
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - e30791742d32146c4fe9ac6bb107ed3a1adeda7f9b0177f6d5fefcb10a7faeb0
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://ggtraff.ru/strik?keyword=estructura+organizativa+tesco+plc+lo
https://uploads.strikinglycdn.com/files/dd5f0e33-ce9a-4944-875c-3668f383af43/bitasalipisisakujizi.pdf
https://uploads.strikinglycdn.com/files/6698202f-8868-40f7-94c6-c34aca784ac5/bazegelipuwisarezatu.pdf
https://uploads.strikinglycdn.com/files/277a133b-cc5e-4b09-9682-e24298f45efa/fedokigojeremiri.pdf
https://uploads.strikinglycdn.com/files/ad7909b8-cbf2-4667-8924-cc6ae118b5d2/88105404238.pdf
https://site-1040528.mozfiles.com/files/1040528/nukozemewo.pdf
https://site-1039324.mozfiles.com/files/1039324/nusajoduzuvasav.pdf
https://site-1042492.mozfiles.com/files/1042492/3580415954.pdf
https://site-1040278.mozfiles.com/files/1040278/zedojudu.pdf
https://uploads.strikinglycdn.com/files/19f6ce99-2b05-4fe7-a5a6-0be4abad0cf5/zelisuzijasitewe.pdf
https://uploads.strikinglycdn.com/files/3996e01b-0aa3-4363-8920-c28ed16132b2/69548276253.pdf
https://uploads.strikinglycdn.com/files/515db470-4115-4e03-a393-779e4356ea6b/luzuvo.pdf
https://uploads.strikinglycdn.com/files/081b9f51-eb27-45c4-a438-3b1fe594deee/gagawulekego.pdf
https://uploads.strikinglycdn.com/files/6db931d3-b3cd-4a8d-a4c6-1ce7f24d3a68/kabirufirup.pdf
https://uploads.strikinglycdn.com/files/c4e46dd6-d23c-4bdf-a5dd-9e4a5d2d20c3/xusebe.pdf
https://uploads.strikinglycdn.com/files/13351e65-c317-4a1f-8dba-ed78f471cfb3/juradowamaputemapu.pdf
https://uploads.strikinglycdn.com/files/eff5247e-7a86-4fdd-a18b-b08eb840956b/9683694664.pdf
https://uploads.strikinglycdn.com/files/96e9b315-07ad-468a-91cc-e6d0ae042db0/64536703989.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt

Embedded domains

ggtraff.ru
uploads.strikinglycdn.com
site-1040528.mozfiles.com
site-1039324.mozfiles.com
site-1042492.mozfiles.com
site-1040278.mozfiles.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

20.42.179.204
135.232.92.137
172.172.255.217
52.123.252.234
52.123.252.248
52.110.12.5
52.110.12.31
72.154.7.104
4.230.171.124
203.26.79.13
74.179.77.164
20.42.65.89
20.165.94.63
20.76.201.171
52.123.128.14
52.123.252.220
135.234.160.246
40.84.97.4
20.184.175.13

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report