MALICIOUS — zaxakaxarukewubiki.pdf
MALICIOUS — zaxakaxarukewubiki.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100). 3 of 23 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
97b0cceeb620f313a29e795995717b6a04ef73f546b4f0a65b1963d2e355a28e - SHA-1:
6a73025ac4028185bd1a1202972d702bb3439ce5 - MD5:
1f5fe76f2ebd2b38ed8d042599054240 - ssdeep:
1536:Ti6IfAkdiqVcKDghp0nnncFzUD/yhfW82WGpOKCWkQIf5nj/hhMu:WS09VcKskc5UD/cOgKKQ2nj/hn - TLSH:
T19D39D0F76057CD8CBB9E9F436EE71129A48ED3446172AA100184F62CE87CA7DBF405A1 - Submitted as: zaxakaxarukewubiki.pdf
- File type: pdf · Size: 84820 bytes
- Verdict: malicious (91/100)
Detections (3 of 23 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The malicious score of 91/100 is the fusion of 7 weighted signals:
- Dropped a malicious payload (Lazarus): root_.cache_dconf_user - dynamic signal, weight 0.80, confidence 0.90
- Contacted 29 external host(s) at runtime (3 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://sunnyvale.com/wysiwygfiles/file/koxaxapi.pdf, http://stellar-toys.com/ckfinder/userfiles/files/5926031963.pdf, http://klinok-saintp.ru/files/fazakibewonag.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
9707 behavior events · 1 ATT&CK techniques · 4 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- searchapp.bundleassets.example
- inference.location.live.net
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- ntp.ubuntu.com
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- desktop-hsgcbep
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- 23.40.52.85
- 23.11.37.157
- 20.190.142.166
Dropped files
- /opt/CAPEv2/storage/analyses/25106/files/41693dec330723f77ee2c15c655fe2ea5f419d044fc6aaff436085ad0b6134f2 -
41693dec330723f77ee2c15c655fe2ea5f419d044fc6aaff436085ad0b6134f2 - /opt/CAPEv2/storage/analyses/25106/files/4a43e300ef7aea8c6bb7c3d46b0397207070bbc831eb50082340ce24d9ee6cb0 -
4a43e300ef7aea8c6bb7c3d46b0397207070bbc831eb50082340ce24d9ee6cb0 - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7 - tmp_tmp.RRWOzKWGpl -
5a04359ba05ad3763548196e416b778ab024e907eefb7a56bc3e15eb31b1f196
Embedded URLs
- https://feedproxy.google.com/~r/skout/mBVl/~3/6naE_Nh8_CY/uplcv?utm_term=thrill+seeker+personality+type
- https://sunnyvale.com/wysiwygfiles/file/koxaxapi.pdf
- http://stellar-toys.com/ckfinder/userfiles/files/5926031963.pdf
- http://klinok-saintp.ru/files/fazakibewonag.pdf
- https://info-jimukyoku.jp/lot/upload/files/44285228918.pdf
- http://foire-fromages-et-vins.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f0382e918d---88934004594.pdf
- http://hzdsbg.com/uploadfile/1629279460.pdf
- http://forglass.sk/userfiles/file/78995021818.pdf
- https://attackworkoutprogram.com/app/webroot/files/ckfinder/userfiles/files/wupaserela.pdf
- https://frontiersneurophotonics.org/wp-content/plugins/formcraft/file-upload/server/content/files/1/160b8880769765---mafabawizakiworasakozamet.pdf
- https://baobihungphu.com/media/ftp/file/37381830440.pdf
- http://www.restorationservice.ca/wp-content/plugins/formcraft/file-upload/server/content/files/16096fb4098d8b---73618873068.pdf
- https://www.lang-mayer.de/wp-content/plugins/formcraft/file-upload/server/content/files/160935174a6694---31353511308.pdf
- http://alliance-ic.ru/uploads/file/31904069701.pdf
- https://calldidocta.com/wp-content/plugins/super-forms/uploads/php/files/2b6c816d4b841a245301f2e36889d301/22271728153.pdf
- http://www.drivingschool-brno.cz/files/files/71023262680.pdf
- http://remontnoedelo.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160a6e7c7a924a---7835223628.pdf
- http://metabolit.ru/files/file/xoleva.pdf
- http://chromatographvials.com/d/files/80478256451.pdf
- https://francoisdaulte.com/ckfinder/userfiles/files/josugupefosuxorowase.pdf
- https://aquafilling.com/userfiles/file/41164143448.pdf
- https://www.baptistenhardenberg.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1608bce0c3a8b9---46958723286.pdf
- https://mediaget.com/userfiles/files/setunologaro.pdf
- https://vetranhtuongmamnon.vn/wp-content/plugins/super-forms/uploads/php/files/89m5seit39lr6nu47r57e7ou29/45399588787.pdf
- https://pindimana.in/uploads/file/81915435458.pdf
Embedded domains
- feedproxy.google.com
- sunnyvale.com
- stellar-toys.com
- klinok-saintp.ru
- info-jimukyoku.jp
- foire-fromages-et-vins.com
- hzdsbg.com
- attackworkoutprogram.com
- frontiersneurophotonics.org
- baobihungphu.com
- www.restorationservice.ca
- www.lang-mayer.de
- alliance-ic.ru
- calldidocta.com
- remontnoedelo.ru
- metabolit.ru
- chromatographvials.com
- francoisdaulte.com
- aquafilling.com
- www.baptistenhardenberg.nl
- mediaget.com
- pindimana.in
- www.w3.org
- purl.org
- ns.adobe.com
Embedded IP addresses
- 20.42.179.192
- 40.84.97.4
- 172.178.240.163
- 52.123.252.212
- 74.178.240.61
- 40.84.85.40
- 52.123.128.14
- 52.123.252.213
- 52.123.129.14
- 162.159.36.2
- 40.103.64.242
- 4.230.171.124
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report