MALICIOUS — normal_5fe6e0751efd2.pdf

MALICIOUS — normal_5fe6e0751efd2.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 8b909c0c334d1e4c8eef3bb5b0414d07a4682e30e533ea5d246c1565ca4cd656
SHA-1: 6502f608a6e4acd44d60bf8e9cd4d6d424a3f7c3
MD5: 993facfeb697936c681b46548406f161
ssdeep: 1536:phU/4n4aG011AXXnU7vSsrxu3NYGkJvRFJSdSpjeCdH:DBQY77aKxudYGoRrSdqjNH
TLSH: T18337D0F76587ED4CB4635B177BB9046AF0898ACCB032DA2595997B3CC8A82FC6C20510
Submitted as: normal_5fe6e0751efd2.pdf
File type: pdf · Size: 74433 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 25 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/1f4951ee-7a63-43f9-bc76-a7a0721352e7/can_you_tame_alphas.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://cctraff.ru/123?utm_term=download+dolphin+emulator+apk+pc, https://cdn-cms.f-static.net/uploads/4365627/normal_5f8a936eee536.pdf, https://uploads.strikinglycdn.com/files/1f4951ee-7a63-43f9-bc76-a7a0721352e7/can_you_tame_alphas.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (7 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9718 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
250.255.255.239.in-addr.arpa
desktop-hsgcbep
ntp.ubuntu.com
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
desktop-hsgcbep._dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 7307b8da3bfa36864618f9e0a44803742cc2dff714ce677ed3d5d15026831ac0
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\a877a4cbf5ebc8d26e148bd8d2ab0c31.png - 3d8d872c58237be16b8862e022663af4ab38386dc52900a6fd0e8fe55a20fccb
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://cctraff.ru/123?utm_term=download+dolphin+emulator+apk+pc
https://cdn-cms.f-static.net/uploads/4365627/normal_5f8a936eee536.pdf
https://uploads.strikinglycdn.com/files/1f4951ee-7a63-43f9-bc76-a7a0721352e7/can_you_tame_alphas.pdf
https://tijabitosivu.weebly.com/uploads/1/3/4/3/134396728/5506537.pdf
https://s3.amazonaws.com/zuponefi/ccrc_college_entrance_form.pdf
https://uploads.strikinglycdn.com/files/3cf58e0c-9676-4226-a689-4002fb24b851/40494858172.pdf
https://vinibakuru.weebly.com/uploads/1/3/4/3/134310820/fodobu.pdf
https://cdn-cms.f-static.net/uploads/4466680/normal_5fa8151e20c98.pdf
https://cdn-cms.f-static.net/uploads/4476418/normal_5fa4fb95f33a7.pdf
https://cdn.sqhk.co/kezixowog/hg4jjgj/the_culture_code_daniel_coyle.pdf
https://tekipagitew.weebly.com/uploads/1/3/4/8/134871071/2655571.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787762823&P2=404&P3=2&P4=EZImdLVwQKICx%2bhteRs8U4yQ29mX%2bzEGtvjjL1v%2frjyhC1RBpnicc2rDOB4C20f2tYV8A7wHu2YBC2ByvIRPfg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787762852&P2=404&P3=2&P4=Gxr3r5%2b%2bqCk53DuNVPdnaK2Ttz1d2Tf3d5eI9S%2fSmI1GL77D9chgWqenAvh%2fLc7EVk8YzsxLiBlSEG2iLR4xJQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

cctraff.ru
cdn-cms.f-static.net
uploads.strikinglycdn.com
tijabitosivu.weebly.com
s3.amazonaws.com
vinibakuru.weebly.com
cdn.sqhk.co
tekipagitew.weebly.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

74.178.76.128
20.184.175.6
4.150.223.115
52.110.12.33
4.230.171.124
135.233.95.144
51.132.193.104
40.104.4.2
52.123.128.14
40.99.133.210
74.178.76.44
172.178.240.162
203.26.79.13
135.233.45.222
48.200.63.27
52.168.117.170
57.155.101.212
52.123.252.198
20.42.73.27
20.42.179.192
172.215.188.232
4.150.223.99
52.123.252.218
57.155.104.224
52.168.112.67

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report