MALICIOUS — normal_5f8ebf2156ff1.pdf

MALICIOUS — normal_5f8ebf2156ff1.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100). 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 7bf8b25b585c8c29c08475c37ba658040335796c8f24eff132175e374394ea94
SHA-1: 27b18dbfb8db2094b827d205e2dfc1faec4429f6
MD5: 0a80be3eacee55cdb322002af268ba01
ssdeep: 1536:wGFYpEi+e9hBT5q6dXLTHVpH81L0xyK26x7i5g7DFP+Pgy:9FYp1b5qUWRKjx7iaN+d
TLSH: T18B34C0F35097ED8D398A9B43ADEB155AA1D9C3C82232A71044CC7A2CD0BC67D7F40992
Submitted as: normal_5f8ebf2156ff1.pdf
File type: pdf · Size: 57146 bytes
Verdict: malicious (84/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 84/100 is the fusion of 6 weighted signals:

Embedded link rated malicious by URL analysis: https://uploads.strikinglycdn.com/files/7ba8d476-6ed7-423f-a291-57931443bb94/kusetiru.pdf - network signal, weight 0.70, confidence 0.80
Contacted 16 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://cctraff.ru/123?keyword=banking+services+chronicle+magazine+november+2020+pdf, https://uploads.strikinglycdn.com/files/7ba8d476-6ed7-423f-a291-57931443bb94/kusetiru.pdf, https://uploads.strikinglycdn.com/files/d419ace3-42aa-4134-917e-33241ab281da/vuxowud.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (5 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9797 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
desktop-hsgcbep._dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787777832&P2=404&P3=2&P4=Btu030SvzqY%2bv4lklxUY89qfhKQWzZIphuY1RgYokFctJWIkjNh09WtxagchNDQwsm1sp9gGhWo%2fl6L5PRllgg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787777868&P2=404&P3=2&P4=g9x92yPKIU4X8%2foFcp10LeJ8XM6ISoyk3p6bGX5LIeZ1lcJ%2b%2bQSsnTQauZhEEiutSywcnB5wUK5tYpIEA6QOIg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\b393a6bda6e9ef94eb1ccb2aa08bac0a.png - 65caa4c772a4013253681f5b3c722a2c0bf443e0473e8ad16dfcad939a9c8bb8
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 4e1344dd98835eed5c451c2d0fba88671fcba7219237f4d52a141884f35d0831
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://cctraff.ru/123?keyword=banking+services+chronicle+magazine+november+2020+pdf
https://uploads.strikinglycdn.com/files/7ba8d476-6ed7-423f-a291-57931443bb94/kusetiru.pdf
https://uploads.strikinglycdn.com/files/d419ace3-42aa-4134-917e-33241ab281da/vuxowud.pdf
https://uploads.strikinglycdn.com/files/4e9eecbb-fa25-403b-8bcd-5ff7fb576726/vivomoraz.pdf
https://uploads.strikinglycdn.com/files/4e9ea839-a607-4774-9046-fd92a8614e31/39405520231.pdf
https://cdn.shopify.com/s/files/1/0439/1731/2152/files/question_words_test.pdf
https://cdn.shopify.com/s/files/1/0497/9248/3490/files/36691899555.pdf
https://cdn.shopify.com/s/files/1/0476/7481/8726/files/android_wear_apk_old_version.pdf
https://cdn.shopify.com/s/files/1/0432/6385/2708/files/scripps_spelling_bee_word_list_2017_with_definitions.pdf
https://pejopazuzaguwoz.weebly.com/uploads/1/3/2/8/132815183/xudiletafini.pdf
https://mogilifus.weebly.com/uploads/1/3/0/7/130739831/7805117.pdf
https://dosaremuxabibi.weebly.com/uploads/1/3/0/7/130739916/bivurizel.pdf
https://siregudak.weebly.com/uploads/1/3/0/7/130738759/7872040.pdf
https://cdn.shopify.com/s/files/1/0501/5568/4002/files/79548261415.pdf
https://cdn.shopify.com/s/files/1/0503/8873/0054/files/ictericia_neonatal_minsa.pdf
https://cdn.shopify.com/s/files/1/0432/1086/6851/files/hayman_reese_brake_controller_instruction_manual.pdf
https://cdn.shopify.com/s/files/1/0502/9661/9193/files/zutovebekuxojep.pdf
https://cdn.shopify.com/s/files/1/0428/8829/8662/files/fewira.pdf
https://cdn.shopify.com/s/files/1/0481/4415/4791/files/factors_influencing_consumer_buying_behaviour.pdf
https://cdn.shopify.com/s/files/1/0504/3050/9254/files/67574215025.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/

Embedded domains

cctraff.ru
uploads.strikinglycdn.com
cdn.shopify.com
pejopazuzaguwoz.weebly.com
mogilifus.weebly.com
dosaremuxabibi.weebly.com
siregudak.weebly.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

52.168.117.174
52.123.252.222
85.210.193.152
4.230.171.124
20.247.185.124
74.178.240.51
74.179.77.204
52.123.129.14
172.178.240.162
74.178.76.44
203.26.79.13
52.123.252.215
172.178.240.161
172.170.180.133
48.200.63.27
20.184.175.3

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report