MALICIOUS — normal_5fc21ddb82dee.pdf

MALICIOUS — normal_5fc21ddb82dee.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: b874fd577f2cb4e4946e3493e92d219821a12d25782e08592245de7ae3ba3de7
SHA-1: 1b207284ce7e243efc36189882ecf0fd7631576f
MD5: ee9eef0f62674b77b3d31eb6ed095663
ssdeep: 1536:Rol6ZgL1RmE6/YleOQ5ZqiQVg2sOm93yspE2aR0wlOUTy9S0kRYVROR5m:il6rAAXZjWT+v2N0wlhTyw0k+g6
TLSH: T1C238D0F360C7CC4976955783B9B8106DA99AC6883533AB7440C4776EC8B83BE6E00B61
Submitted as: normal_5fc21ddb82dee.pdf
File type: pdf · Size: 81537 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://uploads.strikinglycdn.com/files/517cc5f0-832a-468e-903c-b03ecc459fcc/sebolix.pdf - network signal, weight 0.70, confidence 0.80
Contacted 21 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://gettraff.ru/123?utm_term=d-link+dir-655+dd-wrt, https://uploads.strikinglycdn.com/files/517cc5f0-832a-468e-903c-b03ecc459fcc/sebolix.pdf, https://uploads.strikinglycdn.com/files/ab12245a-4541-4e83-8cb8-dd41117b880a/kimam.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (10 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9747 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
ntp.ubuntu.com
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
250.255.255.239.in-addr.arpa
desktop-hsgcbep
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\101dcbb0592e8a182d3fe51ab57bd308.png - 680b4cd74e01b969277248d7ba2c99a144b92a41618ecd4785f5faa548faa073
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 9d76d07267f595281b464c2198e319e5d48e55c4cee9ff4b076c7e59cafaa3e8
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://gettraff.ru/123?utm_term=d-link+dir-655+dd-wrt
https://uploads.strikinglycdn.com/files/517cc5f0-832a-468e-903c-b03ecc459fcc/sebolix.pdf
https://uploads.strikinglycdn.com/files/ab12245a-4541-4e83-8cb8-dd41117b880a/kimam.pdf
https://uploads.strikinglycdn.com/files/e70065f7-390f-481d-8a18-712d1eda27c7/no_module_named_sklearn._impute.pdf
https://cdn-cms.f-static.net/uploads/4367017/normal_5f96878c70add.pdf
https://uploads.strikinglycdn.com/files/f356b776-243b-4007-89bf-381c4d6303ea/71999248555.pdf
https://cdn-cms.f-static.net/uploads/4411220/normal_5f93073b679cf.pdf
https://noxurujoba.weebly.com/uploads/1/3/4/3/134384046/kitax_jupovuv_detonate.pdf
https://uploads.strikinglycdn.com/files/3cb66704-6a6e-4cd3-94e9-df7725cdee08/25794911771.pdf
https://s3.amazonaws.com/fadedosi/jamexebigusigekelusaxez.pdf
https://uploads.strikinglycdn.com/files/73dde517-f3e7-4906-9649-355c4781a17d/epson_stylus_sx415_driver_windows_10_64_bit.pdf
https://uploads.strikinglycdn.com/files/5005f823-cffd-440c-8029-6ce9928e0978/rap_yapma_programlar.pdf
https://tuxupifogufo.weebly.com/uploads/1/3/4/5/134594750/8099184.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787741496&P2=404&P3=2&P4=NN9Iyz%2bmReEnSkj%2fOr%2bhIUnmSlyUa8CJeOXQch%2fILx5ljjYRPlrqjgrwL%2fZ95lSzmSyub%2bYQ%2f9L2Y4%2bI6X3G4A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

gettraff.ru
uploads.strikinglycdn.com
cdn-cms.f-static.net
noxurujoba.weebly.com
s3.amazonaws.com
tuxupifogufo.weebly.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

72.153.5.132
135.232.92.34
4.150.223.107
20.184.175.14
52.110.12.51
48.211.4.16
4.230.171.124
20.247.185.124
74.178.76.128
135.232.92.97
20.236.44.162
52.123.128.14
40.103.64.242
52.168.112.67
74.178.232.29
203.26.79.13
135.234.160.245
20.184.175.5
142.250.195.227
57.155.104.224
20.42.72.131

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report