MALICIOUS — puxajuwomamu.pdf

MALICIOUS — puxajuwomamu.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100). 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: ba3cb61b593de52a3d2a058a2713aaf204d4d0356943ccbe6ef182e4d87e9806
SHA-1: dc1b93c613046df48150d03f8901611293fbf1bd
MD5: 607674cfb1c70b6e1419cc6c0440fad0
ssdeep: 768:mgGzpD7uf1Zvht3AWFmKRVUpRIxJBifvuvhYJt90Lb2tcH0R:zGFPuXQ6mKfUoRifWvhYJba2tcH0R
TLSH: T11032BFF36097DC9C75DA6B079EF10818B548C38C2223A76046D87A2C84FC6FE2F51962
Submitted as: puxajuwomamu.pdf
File type: pdf · Size: 43406 bytes
Verdict: malicious (84/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 84/100 is the fusion of 6 weighted signals:

Embedded link rated malicious by URL analysis: https://uploads.strikinglycdn.com/files/dd3c2ecb-202d-4957-adb1-14fa3f1f3064/vudubapapugikatawopog.pdf - network signal, weight 0.70, confidence 0.80
Contacted 21 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://gettraff.ru/strik?keyword=danteova+bozanstvena+komedija+pdf, https://cdn.shopify.com/s/files/1/0484/0194/0640/files/jowubeferoref.pdf, https://cdn.shopify.com/s/files/1/0437/5334/1082/files/amazon_echo_show_user_manual.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (8 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

10025 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\15a7a53fc388c11f14fa804069f901d2.png - 6a639b083f5576d647f388a5648c07f172872db0b91cf75e3d797d98696456a1
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 3a60cc675908b1c9c2c4ab8201e0c01d8571b426f7d7e65d35a6001df84d65fe
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://gettraff.ru/strik?keyword=danteova+bozanstvena+komedija+pdf
https://cdn.shopify.com/s/files/1/0484/0194/0640/files/jowubeferoref.pdf
https://cdn.shopify.com/s/files/1/0437/5334/1082/files/amazon_echo_show_user_manual.pdf
https://cdn.shopify.com/s/files/1/0437/9679/1456/files/cakewalk_tutorial.pdf
https://uploads.strikinglycdn.com/files/e8dbdd32-77b9-4510-b426-5305db798375/jotoxapabatadumifukepoban.pdf
http://files.angcwestpotomac.com/uploads/1/3/1/4/131413718/de9ac.pdf
http://files.just-abit-off.com/uploads/1/3/2/6/132681080/pukex_tuwazamili_piwebizovevopo_widudiladesopo.pdf
http://files.cottagerowgallerydc.com/uploads/1/3/1/4/131453241/lujele.pdf
https://uploads.strikinglycdn.com/files/dd3c2ecb-202d-4957-adb1-14fa3f1f3064/vudubapapugikatawopog.pdf
https://uploads.strikinglycdn.com/files/55c95878-99f7-4d47-9820-e1a9db93695c/jedogizovirilopofovon.pdf
https://uploads.strikinglycdn.com/files/0cd4eaa3-00bc-4804-9190-d3be079bb2e2/wiwowopuf.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787756552&P2=404&P3=2&P4=kPEzgVbdq1f8VwbaAjH3mFzWw8iRwWSXRxrPS8OQ0ZHWAhr7jqQJQymZ%2f1Eu8fZ0UmlSDatQcrQmrR46yX0fMA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787756633&P2=404&P3=2&P4=ItABR%2bM1cqo2mU9OIKkc%2bbZqJvbXNNn6VeY6lOLx%2bLLWe2w8iZaSWobBpUwf0ZEksglv9VgpUZ1Fw0Xks5UYIA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

gettraff.ru
cdn.shopify.com
uploads.strikinglycdn.com
files.angcwestpotomac.com
files.just-abit-off.com
files.cottagerowgallerydc.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

51.132.193.105
172.172.255.217
20.165.94.63
52.123.252.219
52.110.12.56
52.110.12.26
57.155.104.224
4.230.171.124
20.184.175.20
74.178.240.51
20.231.239.246
40.103.64.226
72.145.35.107
52.123.128.14
40.104.4.2
40.99.134.2
203.26.79.13
74.178.76.128
52.123.252.241
40.74.98.197
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report