MALICIOUS — normal_5f89a2c9976fb.pdf
MALICIOUS — normal_5f89a2c9976fb.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100). 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
aa7c3affa421c133f5c455c6448d5442b520cfaa60a0724aae8688b4738885a6 - SHA-1:
8799310fb11ad2de973268f17bcdc834e15da7d0 - MD5:
0e6813c94bbd10928f539ed71a4c55b8 - ssdeep:
768:qgGzpDwpAK4xMjZtm6gSDZUuDpMbxpEi+pHoxQbg4PyqqTRRTWJdlL26rPV:3GFkpO6cSebfyoybtaDRRTWJ726jV - TLSH:
T11A339FF714A7DD8C7E8BAB036DA211A5548AC78D7133ABE0158C772DC8BC57C6E409A0 - Submitted as: normal_5f89a2c9976fb.pdf
- File type: pdf · Size: 51244 bytes
- Verdict: malicious (84/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 84/100 is the fusion of 6 weighted signals:
- Embedded link rated malicious by URL analysis: https://cdn-cms.f-static.net/uploads/4367275/normal_5f874afbd1d94.pdf - network signal, weight 0.70, confidence 0.80
- Contacted 15 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://ttraff.cc/123?keyword=missguided+returns+policy+ireland, https://cdn-cms.f-static.net/uploads/4365598/normal_5f87043215cdd.pdf, https://cdn-cms.f-static.net/uploads/4367275/normal_5f874afbd1d94.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
9729 behavior events · 0 ATT&CK techniques · 3 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- ntp.ubuntu.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787765079&P2=404&P3=2&P4=bd5y%2buWcs9JPNo7dm9x6kaAoRxF8WdPBwg%2bDoe7ReJfwEdRhzvS1%2fM66bca6KMV8wTWtz3%2fUTjDgaSMMAjXspA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Dropped files
- C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\1030ec36c191e9969c8278f3b985fa56.png -
7d66dd0d0ebf9a6898a330058242d6aa8337947cee1f7fedc60ab962c4468d1c - C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt -
73f5145c4b8f1ed1c75281d351d3fb6d9d87107ecf156e570bc0536f3183b4dd - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://ttraff.cc/123?keyword=missguided+returns+policy+ireland
- https://cdn-cms.f-static.net/uploads/4365598/normal_5f87043215cdd.pdf
- https://cdn-cms.f-static.net/uploads/4367275/normal_5f874afbd1d94.pdf
- https://cdn-cms.f-static.net/uploads/4367938/normal_5f89725f32d81.pdf
- https://cdn-cms.f-static.net/uploads/4365552/normal_5f88a9c5d8a69.pdf
- https://cdn-cms.f-static.net/uploads/4368763/normal_5f87a0abd699e.pdf
- https://uploads.strikinglycdn.com/files/1bd87401-437b-4030-891b-bdfd291685f5/juresidizosavo.pdf
- https://uploads.strikinglycdn.com/files/1ecf1919-d5a8-4b20-a9bf-f8be63a92f9c/difawanol.pdf
- https://uploads.strikinglycdn.com/files/f163eaff-85e4-424c-95fa-78e6019475ca/53570037099.pdf
- https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/3808383.pdf
- https://wuwuleli.weebly.com/uploads/1/3/1/3/131398564/3602492.pdf
- https://gonoloxezejuje.weebly.com/uploads/1/3/1/4/131410007/fixaruve.pdf
- https://uploads.strikinglycdn.com/files/b8b61299-4e75-413e-b00d-3ee84f3d307b/40979730604.pdf
- https://uploads.strikinglycdn.com/files/2adedb3d-4768-4b2e-aca8-302a5d8e71d0/35937744487.pdf
- https://uploads.strikinglycdn.com/files/4b60057b-0b78-45c1-9166-68342811bd5f/zujafulimamurotovuka.pdf
- https://uploads.strikinglycdn.com/files/41292699-e269-4f1f-9d6f-605c814ba1fb/kiruzalidenotutinijomiz.pdf
- https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/aa94aa7f99c.pdf
- https://lerelapukuvi.weebly.com/uploads/1/3/0/7/130740054/9784884.pdf
- https://xuvakaxatal.weebly.com/uploads/1/3/1/0/131070170/nilofizafogujujuxe.pdf
- https://cdn-cms.f-static.net/uploads/4367304/normal_5f88127379c8b.pdf
- https://cdn-cms.f-static.net/uploads/4369797/normal_5f88ea646c6ad.pdf
- https://cdn-cms.f-static.net/uploads/4365653/normal_5f87b3b734d24.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- ttraff.cc
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- gimejexoxixaza.weebly.com
- wuwuleli.weebly.com
- gonoloxezejuje.weebly.com
- lerelapukuvi.weebly.com
- xuvakaxatal.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Embedded IP addresses
- 172.172.255.217
- 4.247.188.224
- 52.123.252.222
- 52.110.12.42
- 4.230.171.124
- 48.211.4.16
- 20.165.94.63
- 74.178.240.51
- 20.236.44.162
- 52.123.129.14
- 20.42.73.28
- 135.233.95.80
- 203.26.79.13
- 52.148.114.188
- 74.178.76.44
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report