MALICIOUS — 6cf392_3eaf847de44e42098020310e537a5d2f.pdf
MALICIOUS — 6cf392_3eaf847de44e42098020310e537a5d2f.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
7d96e464e1eaae591e2b9f4391d101fa80d478cfdeea28aafc595dfe41eb7c6d - SHA-1:
d5f5dc078f01ec3666568274fe4b786b67aa6da6 - MD5:
4e43d97e9d0e6f15836f99bb7d4430d0 - ssdeep:
768:SgGzpDSjT8vq91Kf1/bnQ7B/xC89HAb7COwwM9bkp2fHw48kixYV9:PGFYkUKpbnw7dgHC+oi2fHwEixY7 - TLSH:
T199329EF35067ED8C6A8B9F03999A145E9146C7895033A660559C7B2CC4BC7FDAF00A32 - Submitted as: 6cf392_3eaf847de44e42098020310e537a5d2f.pdf
- File type: pdf · Size: 43338 bytes
- Verdict: malicious (92/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 92/100 is the fusion of 8 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - Contacted 2 external host(s) and 1 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ttraff.com/wix?keyword=eaton+street+theater, https://f4671586-eecf-4514-8653-0a26da02e236.filesusr.com/ugd/db1da1_89f8a15ae58246e0b3b5b9b0f06a3e74.pdf?index=true, https://002b6cd2-2f87-43c7-a6ac-2c647ac374fd.filesusr.com/ugd/93c935_67b5e26f44214660a18f7ba8adb53739.pdf?index=true - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Extracted generic config (12 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
1130 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- searchapp.bundleassets.example
- rb.symcd.com
- rb.symcb.com
- c.pki.goog
- teams.cloud.microsoft
- x2.c.lencr.org
- ye.c.lencr.org
- ntp.ubuntu.com
- http://rb.symcb.com/rb.crl
- http://x2.c.lencr.org/
- 20.190.167.149
- 23.11.37.157
- 150.171.22.17
- 23.40.52.111
- 20.190.167.19
- 23.46.10.30
- 40.79.163.154 AU · Sydney · AS8075 Microsoft Corporation
- 192.168.122.114
- 20.190.167.64
Dropped files
- root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://ttraff.com/wix?keyword=eaton+street+theater
- https://f4671586-eecf-4514-8653-0a26da02e236.filesusr.com/ugd/db1da1_89f8a15ae58246e0b3b5b9b0f06a3e74.pdf?index=true
- https://002b6cd2-2f87-43c7-a6ac-2c647ac374fd.filesusr.com/ugd/93c935_67b5e26f44214660a18f7ba8adb53739.pdf?index=true
- https://3bd0ce73-a0ee-4bc4-bde2-27124d0e4558.filesusr.com/ugd/6f9b04_2d716cc4476c4a74935a4f391bbe4304.pdf?index=true
- https://046271e0-5544-4b74-9052-808681b28479.filesusr.com/ugd/2994dd_d82977ef085c4c598a4996df0858ba6f.pdf?index=true
- https://bc948430-1dc3-4796-ad25-c7952c46dce2.filesusr.com/ugd/53c654_9e04f3958ed34f1783f29bd4df3dd881.pdf?index=true
- http://bemajirod.belizesportsoutreach.com/uploads/1/3/0/7/130775166/fapomi.pdf
- http://dofijas.tiffanyhuertas.com/uploads/1/3/1/3/131381839/43b8dcc997a8729.pdf
- http://saved.atomicagevintage.com/uploads/1/3/2/3/132302870/febimesulanav.pdf
- http://gawukajiw.heartofsamba.com/uploads/1/3/1/8/131857981/83e95b3d5c7.pdf
- https://b125a629-3203-4660-a849-4438a2af78af.filesusr.com/ugd/e50c99_745a0c8a95504342989713a23e2e6d88.pdf?index=true
- https://c2f42421-329e-4ef9-8244-cae7c965f6f8.filesusr.com/ugd/6c032c_f03e4c228ea84c158db5fd942cf9f807.pdf?index=true
- https://cdn.shopify.com/s/files/1/0428/0070/9791/files/40_day_love_dare_for_parents.pdf
- https://cdn.shopify.com/s/files/1/0448/8983/3639/files/analytical_methods_for_atomic_absorption_spectroscopy.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://rb.symcb.com/rb.crl
- http://x2.c.lencr.org/
Embedded domains
- ttraff.com
- f4671586-eecf-4514-8653-0a26da02e236.filesusr.com
- 002b6cd2-2f87-43c7-a6ac-2c647ac374fd.filesusr.com
- 3bd0ce73-a0ee-4bc4-bde2-27124d0e4558.filesusr.com
- 046271e0-5544-4b74-9052-808681b28479.filesusr.com
- bc948430-1dc3-4796-ad25-c7952c46dce2.filesusr.com
- bemajirod.belizesportsoutreach.com
- dofijas.tiffanyhuertas.com
- saved.atomicagevintage.com
- gawukajiw.heartofsamba.com
- b125a629-3203-4660-a849-4438a2af78af.filesusr.com
- c2f42421-329e-4ef9-8244-cae7c965f6f8.filesusr.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
- x2.c.lencr.org
- ye.c.lencr.org
Embedded IP addresses
- 40.79.163.154
- 162.159.36.2
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report