MALICIOUS — normal_5fc3dd3e4f90f.pdf

MALICIOUS — normal_5fc3dd3e4f90f.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 99272174c4ccb966c31579aaf203b299fec600d2875e9644521b7252e3c3df1b
SHA-1: 6d7260d6ba12937cbefd5cf80bfb6fb6c85be3fa
MD5: 9f08f8a7ad5de0bfd15f54c001601221
ssdeep: 3072:7jfMpEZufiToN6YGNZzJqaac42+/MEmt70gYJ9c7/:7MycPuvzAgT+/1AQgJ
TLSH: T19D3CE1F3604BEDCC7786AB13EAF629692086E74412369AE01898F17C847C2FD7D71611
Submitted as: normal_5fc3dd3e4f90f.pdf
File type: pdf · Size: 116490 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://uploads.strikinglycdn.com/files/ad19f764-602a-4ee3-9242-db3e50edafff/stressed_out_twenty_one_pilots_lyrics.pdf - network signal, weight 0.70, confidence 0.80
Contacted 22 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://trafffe.ru/123?utm_term=which+is+not+a+characteristic+of+civilization+as+defined+in+the+lecture, https://uploads.strikinglycdn.com/files/ad19f764-602a-4ee3-9242-db3e50edafff/stressed_out_twenty_one_pilots_lyrics.pdf, https://uploads.strikinglycdn.com/files/1fa84c43-64b0-47ca-bb57-2be509a3b056/sony_ubp_x700.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (10 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9747 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
desktop-hsgcbep
255.255.254.169.in-addr.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
79.243.254.169.in-addr.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
ntp.ubuntu.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\2219e8dc0d7482ae87e7c16b47c863e3.png - 971428332162dcf68964fc0755dea0e1ad64c1f53f743a6ef5717fec6967359c
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 850e2129da5b011a0fd7754dc969a8deab2bbfc3dda572ad7e2ad7a318e6160c
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://trafffe.ru/123?utm_term=which+is+not+a+characteristic+of+civilization+as+defined+in+the+lecture
https://uploads.strikinglycdn.com/files/ad19f764-602a-4ee3-9242-db3e50edafff/stressed_out_twenty_one_pilots_lyrics.pdf
https://s3.amazonaws.com/mukutud/67118201123.pdf
https://uploads.strikinglycdn.com/files/1fa84c43-64b0-47ca-bb57-2be509a3b056/sony_ubp_x700.pdf
https://uploads.strikinglycdn.com/files/d67882cc-7e73-43fc-973c-a92a50f75956/52583252208.pdf
https://uploads.strikinglycdn.com/files/ebf0a31a-b6f8-40fd-baf0-88b8ec028e01/jdk-7u79-windows-i586.exe_free_download.pdf
https://cdn-cms.f-static.net/uploads/4450734/normal_5fa141cf6693b.pdf
https://cdn-cms.f-static.net/uploads/4384143/normal_5fc1e06e6558d.pdf
https://cdn-cms.f-static.net/uploads/4409092/normal_5f95168365b76.pdf
https://zipazoraxegav.weebly.com/uploads/1/3/4/3/134325660/sejagopodagadin-gopododubozok-fikoganotoj.pdf
https://cdn-cms.f-static.net/uploads/4369317/normal_5f8b6c8f8aeda.pdf
https://s3.amazonaws.com/gumegulaxi/emporio_armani_underwear_size_guide.pdf
https://uploads.strikinglycdn.com/files/2b92cff4-2ddc-465c-a27e-e93cba30dfc0/kivuraresopizutetub.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787745097&P2=404&P3=2&P4=gHkDIeYcGEoPuIVnc1LzCsbXj3SlGi08uuDQeov%2ft8HfCr5BkyjgeUkVzSdWCH0EEeIwJ4Kvu1%2bmW%2fouIE12zg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

trafffe.ru
uploads.strikinglycdn.com
s3.amazonaws.com
cdn-cms.f-static.net
zipazoraxegav.weebly.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

74.178.76.44
51.132.193.105
20.184.175.5
172.172.255.218
135.232.92.137
40.84.97.4
52.123.252.242
52.110.12.54
52.110.12.53
4.230.171.124
20.247.184.197
51.11.192.48
52.123.128.14
52.123.129.14
40.103.64.226
72.153.5.97
203.26.79.13
20.42.73.24
48.211.4.16
92.223.78.30
142.251.222.3
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report