MALICIOUS — pezebarosugok.pdf

MALICIOUS — pezebarosugok.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100). 3 of 50 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: aa542a3de734d0abd93d7477c6c40b19e0f82893916bbb75530f178eb7d404a1
SHA-1: 878db7e97dfefe5d70541801bb2c3230da48412c
MD5: e5d5cfc2158e8014103482e13b5b70b6
ssdeep: 1536:vGF4pFmkQ0StIlR7QlX1LrTX9SHBF6seDqfIIL:eF4pFm9ti7ElLHX2uofH
TLSH: T16035BFF350A7EC4CBA8B6B13BEE60199698AD3887076E66019CC776CD07C2FD5E01611
Submitted as: pezebarosugok.pdf
File type: pdf · Size: 57688 bytes
Verdict: malicious (91/100)

Detections (3 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Emsisoft (Emergency Kit): PDF.Spam.Heur.1

MITRE ATT&CK

Why this verdict

The malicious score of 91/100 is the fusion of 7 weighted signals:

Dropped a malicious payload (Lazarus): root_.cache_dconf_user - dynamic signal, weight 0.80, confidence 0.90
Contacted 30 external host(s) at runtime (7 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://gettraff.ru/strik?keyword=the+culture+clash+jean+donaldson+pdf, http://files.betzalelarts.com/uploads/1/3/1/8/131857983/df104.pdf, http://mozekizuw.redeemernewton.org/uploads/1/3/0/8/130813042/6ea785dd79333.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9730 behavior events · 1 ATT&CK techniques · 4 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e?P1=1787094771&P2=404&P3=2&P4=JAMt4toEu4akGzbUGEOYaxl8I%2fVMynfRRxlU5Nmna3qSGWOIRz6kB1xSJ10n%2fdw%2fkBcX4jK7EHf0I7VS%2fZU5sw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/58b2a9b1-8570-476c-a7c2-f7ab0a20fbf9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/58b2a9b1-8570-476c-a7c2-f7ab0a20fbf9?P1=1787094807&P2=404&P3=2&P4=AG%2bBOEULCvcKKPEOwc8rUjvb%2bAqWibMNy6e5RelXV1UaltBZizWjfC5LzpR9P%2bK5W5nM8%2faw%2bp8EuIw1lDIslg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
23.40.52.85
23.11.37.157
40.126.14.160

Dropped files

/opt/CAPEv2/storage/analyses/30805/files/006b4e6d09af3b8773b8a1cb1d443224100d1cc1a4b435ad5f2e1c25b04c6c8b - 006b4e6d09af3b8773b8a1cb1d443224100d1cc1a4b435ad5f2e1c25b04c6c8b
/opt/CAPEv2/storage/analyses/30805/files/647d90877d6e7a44c44e166dcea12b2369e2cd3b55bf770aa26057664d0cfafa - 647d90877d6e7a44c44e166dcea12b2369e2cd3b55bf770aa26057664d0cfafa
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
tmp_tmp.DZGDCXCvob - a8e70cce903a6ad2e4bf6c9298501efec9d425aa1b1b9c527f1f4e180ce69678

Embedded URLs

https://gettraff.ru/strik?keyword=the+culture+clash+jean+donaldson+pdf
http://files.betzalelarts.com/uploads/1/3/1/8/131857983/df104.pdf
http://mozekizuw.redeemernewton.org/uploads/1/3/0/8/130813042/6ea785dd79333.pdf
http://xiwejabak.brendathebeauabstracts.com/uploads/1/3/2/3/132303127/864444.pdf
http://lixofebo.communityfoundationoforange.org/uploads/1/3/1/6/131636612/jisul.pdf
http://jabata.aim4theworld.org/uploads/1/3/0/9/130969265/475bf.pdf
https://cdn.shopify.com/s/files/1/0431/4556/0226/files/jevuwewobusuz.pdf
https://cdn.shopify.com/s/files/1/0432/5031/9528/files/mario_theme_song_sheet_music_trumpet.pdf
https://cdn.shopify.com/s/files/1/0481/4114/0131/files/puvisak.pdf
https://cdn.shopify.com/s/files/1/0428/5543/2348/files/47249510323.pdf
https://cdn.shopify.com/s/files/1/0482/9924/5723/files/xizonexupe.pdf
http://kisugesa.labrisacademy.org/uploads/1/3/1/4/131437354/timagoz-wudujika-fokuzesafep.pdf
http://files.feng-ge.net/uploads/1/3/1/0/131070207/4cc6e9684a2e.pdf
http://files.gnostictattoo.com/uploads/1/3/1/6/131636655/3ad5486747a.pdf
http://simewisam.strongagriculturalsociety.com/uploads/1/3/0/8/130814471/vawejuzeb.pdf
http://files.bradleyestates.co.uk/uploads/1/3/2/6/132682570/wirifobeje.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

gettraff.ru
files.betzalelarts.com
mozekizuw.redeemernewton.org
xiwejabak.brendathebeauabstracts.com
lixofebo.communityfoundationoforange.org
jabata.aim4theworld.org
cdn.shopify.com
kisugesa.labrisacademy.org
files.feng-ge.net
files.gnostictattoo.com
simewisam.strongagriculturalsociety.com
files.bradleyestates.co.uk
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

20.42.72.131
52.110.12.5
57.155.104.224
4.230.171.124
4.144.132.223
74.178.76.128
52.168.117.171
74.178.76.44
72.154.7.102
203.26.79.13
20.184.175.6
74.178.240.61
48.199.12.1
4.207.44.77
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report