SUSPICIOUS — normal_5f87849ab3fb7.pdf
SUSPICIOUS — normal_5f87849ab3fb7.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (64/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
9319e638bf958aa6532bde8ef5333a386445d4f3b1a3e7a95599e5df57113f6f - SHA-1:
87b34c0c7fcdfd87148820c01a0327a919ae1fe9 - MD5:
6481411dd56b3e5fb4fe8d5602a77ad6 - ssdeep:
768:/gGzpDQpXV3wO6YNNYb/xHJN3l9rAvrKCGXFniOaeO3xsxHCUdkXoLrTK5CZGwyI:IGF8pXVs3l5Arlz4HCxyS5CZxFAIii7J - TLSH:
T170317DF35097EC4D7A8B6F03ADAB015964CAC38DA136D7A0459C276CC1BCAFD6E40A11 - Submitted as: normal_5f87849ab3fb7.pdf
- File type: pdf · Size: 39489 bytes
- Verdict: suspicious (64/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The suspicious score of 64/100 is the fusion of 5 weighted signals:
- Contacted 12 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://gettraff.ru/123?keyword=gradeup+banking+awareness+pdf+2020, https://cdn-cms.f-static.net/uploads/4366004/normal_5f871938365e5.pdf, https://cdn-cms.f-static.net/uploads/4366341/normal_5f872469eb7ec.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
9717 behavior events · 0 ATT&CK techniques · 3 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- _dosvc._tcp.local
- ntp.ubuntu.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787779773&P2=404&P3=2&P4=WFF6PY2kny2lP59GNy72SZGccWDMjKT0yeByIhHYQHuJL%2b050e92zkQK2KrfOqzezNGEiKZItiv0U9Nq5R%2f%2bnA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787779824&P2=404&P3=2&P4=E9gZbaq2m%2fZWdkr2m6t8MssXc1qj7ZErUdFcSa8s80QdY5BvAx4zy43rfbsUR1grZ%2bA%2bbWoopPlxPE%2fxIBgwTA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- 23.40.52.85
Dropped files
- C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt -
1bcb8d3236ddce3f1480e8d5bc3ee1b80be9438832c9810043ae4424932123ab - C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\bad9c73375708706a06221c40e5f0b02.png -
272762b1c4e833c2672c0836171fb97f8f676f028995ab55bc4de02f2cfda595 - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://gettraff.ru/123?keyword=gradeup+banking+awareness+pdf+2020
- https://cdn-cms.f-static.net/uploads/4366004/normal_5f871938365e5.pdf
- https://cdn-cms.f-static.net/uploads/4366341/normal_5f872469eb7ec.pdf
- https://cdn-cms.f-static.net/uploads/4366354/normal_5f8784197bd5f.pdf
- https://cdn-cms.f-static.net/uploads/4365594/normal_5f8783dce5b7e.pdf
- https://cdn-cms.f-static.net/uploads/4367310/normal_5f87566dacbbe.pdf
- https://cdn-cms.f-static.net/uploads/4366316/normal_5f87746ead06b.pdf
- https://cdn-cms.f-static.net/uploads/4366642/normal_5f87723c5aa5a.pdf
- https://cdn-cms.f-static.net/uploads/4366344/normal_5f876e4214a3b.pdf
- https://cdn-cms.f-static.net/uploads/4366302/normal_5f877195641b8.pdf
- https://cdn-cms.f-static.net/uploads/4365549/normal_5f8702f9567fd.pdf
- https://uploads.strikinglycdn.com/files/7b2ac352-569f-4d09-be5f-2c54b4922d68/xotazi.pdf
- https://uploads.strikinglycdn.com/files/99a9448a-52fc-4eb8-8e34-fcff75ba2b7b/sududo.pdf
- https://uploads.strikinglycdn.com/files/601d3f73-c96d-4f0a-9dc8-d153afb466fc/3683560566.pdf
- https://cdn.shopify.com/s/files/1/0268/9187/8585/files/vurisijoborotivexajuxo.pdf
- https://cdn.shopify.com/s/files/1/0498/1384/8219/files/8194201674.pdf
- https://cdn.shopify.com/s/files/1/0496/1268/5461/files/89479363469.pdf
- https://cdn.shopify.com/s/files/1/0483/3542/1593/files/el_exorcista_libro.pdf
- https://cdn.shopify.com/s/files/1/0496/5462/8516/files/sodastream_source_not_working.pdf
- https://cdn.shopify.com/s/files/1/0480/8566/3908/files/parallel_editing_in_inception.pdf
- https://cdn.shopify.com/s/files/1/0497/5080/2595/files/39020210335.pdf
- https://cdn.shopify.com/s/files/1/0432/1447/1330/files/concave_lens_ray_diagram.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- gettraff.ru
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Embedded IP addresses
- 52.110.12.53
- 48.211.4.16
- 4.230.171.124
- 20.247.184.197
- 74.178.240.51
- 20.231.239.246
- 20.165.94.63
- 52.123.129.14
- 40.99.133.226
- 72.154.7.111
- 203.26.79.13
- 52.168.117.175
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report