MALICIOUS — 8bc7bbfc60dba3928611f77d80508bbf77762657d6be35106146830b5fe5edc5

Verdict: malicious (85/100) · Family: unknown

File type: pdf · SHA-256: 8bc7bbfc60dba3928611f77d80508bbf77762657d6be35106146830b5fe5edc5

MITRE ATT&CK

• T1112
• T1105

YARA

Dynamic analysis (windows)

9585 behavior events · 1 ATT&CK techniques · 4 dropped files.

Runtime network

• www.msftconnecttest.com
• inference.location.live.net
• 250.255.255.239.in-addr.arpa
• ntp.ubuntu.com
• http://www.msftconnecttest.com/connecttest.txt
• 23.40.52.85
• 40.126.14.160
• 52.168.112.67 US · Chantilly · AS8075 Microsoft Corporation
• 150.171.22.17
• 23.33.238.178
• 52.110.12.21 AU · Sydney · AS8075 Microsoft Corporation
• 4.230.171.124 KR · Seoul · AS8075 Microsoft Corporation
• 57.155.104.224 SG · Singapore · AS8075 Microsoft Limited UK
• 23.33.238.110
• 52.253.84.76 SG · Singapore · AS8075 Microsoft Corporation
• 135.233.95.80 US · Des Moines · AS8075 Microsoft Limited
• 23.221.133.185
• 92.223.78.30 AU · Sydney · AS199524 G-Core Labs Customer assignment
• 23.40.52.123
• 151.101.30.172

Analyzed on MalwareAnalyzer by Cyble · Open interactive report