MALICIOUS — bubifapakorubera.pdf

Verdict: malicious (93/100) · Family: unknown

File type: pdf · SHA-256: 9f77d5dd5534ec92454c283e21bfccfa194671f2f85a5f44a7e0ecea21d9086d

MITRE ATT&CK

• T1112
• T1105
• T1566.002

YARA

Dynamic analysis (windows)

9701 behavior events · 1 ATT&CK techniques · 4 dropped files.

Runtime network

• www.msftconnecttest.com
• inference.location.live.net
• _dosvc._tcp.local
• ntp.ubuntu.com
• http://www.msftconnecttest.com/connecttest.txt
• http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786395307&P2=404&P3=2&P4=ls7NBfFg5K6sRZmFN0u8NQrKJC0wcLILYDAkZAYx0ZfxubjtSXFf7oB9mym6mQP2bocpc8fWDtmqolJvZGkhgg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786395348&P2=404&P3=2&P4=ByzkXowwF1cJR1rYNm5b8F9Ot7p%2foi8szBDq9w9p%2bBnQ5rpQlJR50bG3dRfHg2i1lLxNzMkLemmUX9K6QHEkzg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
• 23.40.52.209
• 20.190.142.165
• 20.42.65.94
• 52.123.252.204
• 23.198.40.44
• 52.110.12.48
• 4.230.171.124
• 23.46.179.27
• 57.155.104.224
• 104.72.70.178
• 20.247.184.197

Analyzed on MalwareAnalyzer by Cyble · Open interactive report