SUSPICIOUS — bimaxobeduwobozu.pdf

SUSPICIOUS — bimaxobeduwobozu.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (68/100). 3 of 50 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: a59006222d45062740295ca6415f6970e815e41198f2e6b095b20291de52e5d8
• SHA-1: 875c64c1e6a22ee343601a141bfb649158edbf9b
• MD5: 5264d28a3ca17593cfc737f967e9af22
• ssdeep: 768:HgGzpDoV7Fq55WVCQ6Y4sag7w2Cvjh6EimeAUnzMiO++FYmS+8Rf8:AGFU1sQT5aMw2Cvl6xPA0MiR+FrSFRf8
• TLSH: T11C31AEF31097DD8D3A9B7B036DAB015D624AD78C6132AA6418C87B2CC4BC7EDBE00955
• Submitted as: bimaxobeduwobozu.pdf
• File type: pdf · Size: 42578 bytes
• Verdict: suspicious (68/100)

Detections (3 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

• T1112
• T1105

Why this verdict

The suspicious score of 68/100 is the fusion of 6 weighted signals:

• Contacted 12 external host(s) at runtime (3 HTTP) - network signal, weight 0.40, confidence 0.80
• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=the+story+of+an+hour+pdf+answers, http://files.ohlimousine.com/uploads/1/3/1/4/131438464/416dc958.pdf, http://xewigo.mysuisselife.com/uploads/1/3/1/0/131070356/kopezigikufuzo.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9805 behavior events · 1 ATT&CK techniques · 3 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• 252.0.0.224.in-addr.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• desktop-hsgcbep
• desktop-hsgcbep._dosvc._tcp.local
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 250.255.255.239.in-addr.arpa
• desktop-hsgcbep(1)._dosvc._tcp.local
• 255.255.254.169.in-addr.arpa
• 79.243.254.169.in-addr.arpa

Dropped files

• C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - fc5c367fee31a8182d7878935e224c96e2805a1007d549f5b97c6d025723e612
• C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\511f19bac065bcb47cef34fdbceb63d7.png - 64739fbbb306fdb0a0b45297ddedf65f60a983c8fa218fdb78b50032ff4feff5
• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://ggtraff.ru/strik?keyword=the+story+of+an+hour+pdf+answers
• http://files.ohlimousine.com/uploads/1/3/1/4/131438464/416dc958.pdf
• http://xewigo.mysuisselife.com/uploads/1/3/1/0/131070356/kopezigikufuzo.pdf
• http://files.salt-tz.com/uploads/1/3/0/7/130776001/tatagotim.pdf
• https://cdn.shopify.com/s/files/1/0433/6726/8517/files/71739936910.pdf
• https://cdn.shopify.com/s/files/1/0428/2544/9628/files/15911205726.pdf
• https://cdn.shopify.com/s/files/1/0431/8547/1656/files/25294212733.pdf
• https://cdn.shopify.com/s/files/1/0488/2507/3829/files/90989144893.pdf
• https://cdn.shopify.com/s/files/1/0484/3657/6410/files/writing_and_naming_ionic_compounds_answer_key.pdf
• http://files.kparkerdesign.net/uploads/1/3/1/6/131607269/sujalebululoni.pdf
• http://files.stoicqabalah.com/uploads/1/3/2/7/132710794/ninuvaxesafosu.pdf
• http://files.rmisuw.org/uploads/1/3/1/4/131437233/dixasufipika.pdf
• http://xiludep.mcfcconference.com/uploads/1/3/0/7/130775320/saluk.pdf
• http://jeninuv.andquirky.co.uk/uploads/1/3/1/6/131606624/zesenigurero-xegarakuviwu.pdf
• http://files.hollismeadorganicdairy.co.uk/uploads/1/3/0/7/130740069/8511119.pdf
• http://totokuges.hairandmakeupbydesire.com/uploads/1/3/1/4/131452836/914286bb5d55.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• ggtraff.ru
• files.ohlimousine.com
• xewigo.mysuisselife.com
• files.salt-tz.com
• cdn.shopify.com
• files.kparkerdesign.net
• files.stoicqabalah.com
• files.rmisuw.org
• xiludep.mcfcconference.com
• jeninuv.andquirky.co.uk
• files.hollismeadorganicdairy.co.uk
• totokuges.hairandmakeupbydesire.com
• www.w3.org
• purl.org
• ns.adobe.com

Embedded IP addresses

• 52.110.12.25
• 52.110.12.33
• 20.42.179.204
• 4.230.171.124
• 172.215.188.225
• 74.178.76.128
• 20.42.73.25
• 20.231.239.246
• 203.26.79.13
• 52.123.129.14
• 40.99.134.18
• 74.178.232.29

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report