MALICIOUS — normal_5fcdea257d4cf.pdf

MALICIOUS — normal_5fcdea257d4cf.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 9018074b8111f7ef5c472a4df0c0de4837cef7b01e31b9a488d9a94e0cff4098
SHA-1: 68b93d67e8ac38f45dca0f7b17420b9440485aca
MD5: 5d4a4d4839efff2ac9c56c1f38fdc8f3
ssdeep: 1536:P9ZKtynDGMW2YvLHioO3BWGcU4eVbVh9Vs3jDLJ6pGnISqfbx6/:6+GMFYWhRIkYX1E+ISqzQ
TLSH: T1F636D0F361A7DE8C73EC6B0376A7115C3650D2DAB0326BA04888B66DC66C5FC3D54A12
Submitted as: normal_5fcdea257d4cf.pdf
File type: pdf · Size: 67708 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://uploads.strikinglycdn.com/files/d25b7a23-6caf-4a54-92c6-7d238cc04bb0/84574626750.pdf - network signal, weight 0.70, confidence 0.80
Contacted 30 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://traffset.ru/123?utm_term=blood+brothers+marilyn+monroe+2+lyrics, https://static1.squarespace.com/static/5fc0e90c27a199023ab56552/t/5fc46fb661e25426e1c641e0/1606709175170/43442272222.pdf, https://uploads.strikinglycdn.com/files/d8f8da56-9c6d-4a69-afcb-d72968c00187/second_part_of_declaration_of_independence.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (5 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9720 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 38ae3855642131a25739d85caa1a23d8f2517e26d5072cb2dfd0cea620f1f8f8
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\e9067c62d12bd9aa724feda409ed8d71.png - b529970041a49ef8c41ae5061ed183ebe35a495c97eb0964786741a11b938f12
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://traffset.ru/123?utm_term=blood+brothers+marilyn+monroe+2+lyrics
https://static1.squarespace.com/static/5fc0e90c27a199023ab56552/t/5fc46fb661e25426e1c641e0/1606709175170/43442272222.pdf
https://uploads.strikinglycdn.com/files/d8f8da56-9c6d-4a69-afcb-d72968c00187/second_part_of_declaration_of_independence.pdf
https://uploads.strikinglycdn.com/files/d25b7a23-6caf-4a54-92c6-7d238cc04bb0/84574626750.pdf
https://mizitixas.weebly.com/uploads/1/3/4/5/134589849/xogobinu.pdf
https://s3.amazonaws.com/fowonaxul/hd_wallpaper_for_laptop_windows_10.pdf
https://static1.squarespace.com/static/5fc5d30b7848ba205d3a93a9/t/5fc6e30509f4d56e8f755f7d/1606869766144/jevegibepelepasu.pdf
https://xunitumewotoril.weebly.com/uploads/1/3/4/6/134612341/zerotoxisikalo.pdf
https://uploads.strikinglycdn.com/files/d0a27f7b-ac25-4dba-b209-0e704932abb8/convertidor_de_temperatura.pdf
https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcf10b79c08c7f2b9da5c5/1606217996848/one_more_flight_friv.pdf
https://static1.squarespace.com/static/5fc013a70a2757459bde56bb/t/5fc0dcb61972c46e3cbe8972/1606474940463/mla_citation_worksheet.pdf
https://static.s123-cdn-static.com/uploads/4490523/normal_5fc7412b5e2a6.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787755208&P2=404&P3=2&P4=jbRN7WtXcwU4zkUvS8mBsl8t3%2fyQ2njFs1EWs87gW6CkDXWgH7hZbUAckF57Aze8a2kEWr1AWu%2buzBcWWZPwVw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787755283&P2=404&P3=2&P4=eyJVndCcRsvzQNj8MEaY5klBitcyAEI3FE2IdunjnHkFaHBgGe5%2fs1wpLOBfq6y63chenYjxNDjnHU0Iiz2UtQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

traffset.ru
static1.squarespace.com
uploads.strikinglycdn.com
mizitixas.weebly.com
s3.amazonaws.com
xunitumewotoril.weebly.com
static.s123-cdn-static.com
6.su
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

40.84.85.40
20.42.65.88
135.233.95.144
52.123.128.14
4.150.223.101
52.168.117.174
104.46.162.230
52.123.252.240
52.110.12.22
4.230.171.124
72.154.7.99
203.26.79.13
4.155.94.154
135.232.92.137
20.184.175.11
52.123.252.231
20.76.201.171
40.103.64.242
20.42.73.26
52.123.252.234
52.123.129.14
40.103.64.226
135.234.160.245
74.179.71.159
92.223.78.30

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report