MALICIOUS — normal_5f8ba0e758d1c.pdf
MALICIOUS — normal_5f8ba0e758d1c.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (72/100). 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
b926201771818b9d5b805b8e6d398ca2934e54a62fe0c9e61df2e389b8075f65 - SHA-1:
f12537fcb96ccf9fe8c7dc216397381e725f2192 - MD5:
9e7e1bb49db5443824833f1f33b636a4 - ssdeep:
768:ZgGzpD5pA/ocqbidL++pRmvWVgS8V2+4dy3MAkiQlVMge7w8k2SXEt3wx5floccd:aGF9pA/oZGye/h0hPtgb2NBesd - TLSH:
T1DB328EF310A7EC4C7AC79B13ADAA256C249ED6886237D36114CC777DC4BC26D6E50820 - Submitted as: normal_5f8ba0e758d1c.pdf
- File type: pdf · Size: 43490 bytes
- Verdict: malicious (72/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 72/100 is the fusion of 6 weighted signals:
- Contacted 23 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded link rated suspicious by URL analysis: https://cdn-cms.f-static.net/uploads/4366382/normal_5f874106a1d6c.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://cctraff.ru/123?keyword=sprint+2+teacher%2527s+book+pdf, https://cdn-cms.f-static.net/uploads/4366389/normal_5f8ae68f47aa3.pdf, https://cdn-cms.f-static.net/uploads/4371248/normal_5f8b74d52ccf2.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: additional-actions, uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Extracted generic config (12 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
9751 behavior events · 0 ATT&CK techniques · 3 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- c.pki.goog
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- ntp.ubuntu.com
- _dosvc._tcp.local
- desktop-hsgcbep._dosvc._tcp.local
- desktop-hsgcbep(1)._dosvc._tcp.local
- http://www.msftconnecttest.com/connecttest.txt
Dropped files
- C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt -
0a17a174459efcec4dd687fb553fe2256f4217192a132858d7e7cd9438d11f26 - C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\f49132410fab2a7bf8cfae9cb97362cb.png -
65437df00c55d1482f72f86f6729355fd88a7abfa78994b1844a6e01c7ddf6f2 - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://cctraff.ru/123?keyword=sprint+2+teacher%2527s+book+pdf
- https://cdn-cms.f-static.net/uploads/4366389/normal_5f8ae68f47aa3.pdf
- https://cdn-cms.f-static.net/uploads/4371248/normal_5f8b74d52ccf2.pdf
- https://cdn-cms.f-static.net/uploads/4366305/normal_5f8730a5bb176.pdf
- https://cdn.shopify.com/s/files/1/0498/4170/1026/files/98965089575.pdf
- https://cdn.shopify.com/s/files/1/0432/5657/8206/files/closed_form_definition_art.pdf
- https://cdn-cms.f-static.net/uploads/4365636/normal_5f8b982a9be32.pdf
- https://cdn-cms.f-static.net/uploads/4367648/normal_5f896ee5593b1.pdf
- https://cdn-cms.f-static.net/uploads/4373519/normal_5f88f071f0edd.pdf
- https://xofilovinavi.weebly.com/uploads/1/3/1/3/131379248/7988294e2349f42.pdf
- https://bezebaterizijir.weebly.com/uploads/1/3/1/3/131384714/gufirufotuw.pdf
- https://nurekagenarufab.weebly.com/uploads/1/3/1/6/131636906/1609079.pdf
- https://cdn-cms.f-static.net/uploads/4368747/normal_5f8b5688997c7.pdf
- https://cdn-cms.f-static.net/uploads/4366382/normal_5f874106a1d6c.pdf
- https://cdn-cms.f-static.net/uploads/4374203/normal_5f892c28ce708.pdf
- https://cdn-cms.f-static.net/uploads/4379049/normal_5f8b34173f894.pdf
- https://cdn-cms.f-static.net/uploads/4367019/normal_5f875601d7a70.pdf
- https://cdn.shopify.com/s/files/1/0266/8648/8767/files/aapko_kya_chahiye_english.pdf
- https://cdn.shopify.com/s/files/1/0434/1887/8104/files/30424660862.pdf
- https://cdn.shopify.com/s/files/1/0497/9127/1073/files/59335285671.pdf
- https://cdn.shopify.com/s/files/1/0432/6627/7534/files/32224956350.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- cctraff.ru
- cdn-cms.f-static.net
- cdn.shopify.com
- xofilovinavi.weebly.com
- bezebaterizijir.weebly.com
- nurekagenarufab.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Embedded IP addresses
- 20.165.94.46
- 40.84.85.40
- 4.247.188.233
- 4.247.188.224
- 72.145.35.96
- 135.233.95.144
- 52.123.252.227
- 52.123.252.220
- 57.155.101.212
- 74.179.71.159
- 52.110.12.26
- 4.230.171.124
- 85.210.196.11
- 203.26.79.13
- 20.42.179.204
- 52.230.60.54
- 135.233.95.135
- 52.123.129.14
- 40.103.64.242
- 142.250.195.131
- 135.233.45.223
- 4.209.250.170
- 135.232.92.34
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report