MALICIOUS — mawamawaburer.pdf

MALICIOUS — mawamawaburer.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: ac199e6079d8354152609df8fd22669d59de647336e71c15b71383d15f9c7682
SHA-1: 3ff4a61f446fc1b952db4d8a9016ca561f9eb087
MD5: 97ad9293e52110bdc4e11b91f86abe0f
ssdeep: 1536:FFU3PmOr+pq0t5nd9rQyXXafwoPBAOjtBiLC3ofSm3yWhtGTjJ/dSi:oTrItt5njrQyH9jotBn3eSm3XMJ/B
TLSH: T12F37D1F3354BCD8CB789BB83A9F519A9909ADA883532AF6094C07A5CC47C66D3D14F10
Submitted as: mawamawaburer.pdf
File type: pdf · Size: 74889 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Contacted 18 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/35357095-8d25-4cfd-8919-b258cadfa7c1/pediatric_swallowing_and_feeding_ass.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://trafffe.ru/strik?utm_term=blackmart+alpha+uptodown, https://uploads.strikinglycdn.com/files/35357095-8d25-4cfd-8919-b258cadfa7c1/pediatric_swallowing_and_feeding_ass.pdf, https://uploads.strikinglycdn.com/files/d60c2a24-ffd1-4a9a-abb9-c4a2f30b024d/lixafifavezogonaworuke.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (4 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9792 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
250.255.255.239.in-addr.arpa
ntp.ubuntu.com
_dosvc._tcp.local
desktop-hsgcbep._dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787778005&P2=404&P3=2&P4=Zubfg%2bdsEAQgkxK5BItGB8LyVEE6C3agqeD8u0bQX8Ok3jtDHzO2cEecrKSqnzijmAuMk5cCGfQOn%2fRKAq6AqQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - c6d92a1918f61d8e92609704aa74957a12e2884c52d1f7547d90b83ed17a1031
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\f6d001ad3813bc8eeadd84a0a069f53d.png - 82f19da3cfada859ca004208d11bc25df0094d058cffe7f852ee586f73a337df
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://trafffe.ru/strik?utm_term=blackmart+alpha+uptodown
https://uploads.strikinglycdn.com/files/35357095-8d25-4cfd-8919-b258cadfa7c1/pediatric_swallowing_and_feeding_ass.pdf
https://s3.amazonaws.com/gupuso/sigudokeguj.pdf
https://s3.amazonaws.com/gomakobez/bts_love_yourself_answer_photoshoot_l_version.pdf
https://s3.amazonaws.com/belopudevuzuza/fishing_reels_walmart.pdf
https://s3.amazonaws.com/sepovutapakogaf/24422524748.pdf
https://s3.amazonaws.com/lofese/chunky_platform_lace_up_booties.pdf
https://uploads.strikinglycdn.com/files/d60c2a24-ffd1-4a9a-abb9-c4a2f30b024d/lixafifavezogonaworuke.pdf
https://s3.amazonaws.com/sugowubuf/chocolate_movie_songs.pdf
https://gitufigekuxos.weebly.com/uploads/1/3/4/6/134634758/pavosisefebowa_didewezoveve_polibemila_bilupoj.pdf
https://uploads.strikinglycdn.com/files/452784af-de44-4c3f-9863-69ea0996c290/18010324726.pdf
https://s3.amazonaws.com/ribowexulo/94383568528.pdf
https://tuvomirunasoz.weebly.com/uploads/1/3/4/3/134324776/7a2fa45584492.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787778005&P2=404&P3=2&P4=Zubfg%2bdsEAQgkxK5BItGB8LyVEE6C3agqeD8u0bQX8Ok3jtDHzO2cEecrKSqnzijmAuMk5cCGfQOn%2fRKAq6AqQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

trafffe.ru
uploads.strikinglycdn.com
s3.amazonaws.com
gitufigekuxos.weebly.com
tuvomirunasoz.weebly.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

172.215.188.232
203.26.79.13
172.172.255.217
20.42.179.204
172.215.188.225
72.153.5.128
4.230.171.124
40.84.85.40
74.179.77.204
4.207.44.74
52.123.128.14
40.104.4.2
52.123.252.216
52.123.252.233
74.179.71.159
142.250.195.227
135.234.160.245
4.209.250.170

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report