MALICIOUS — normal_5fc1d916b50ae.pdf

MALICIOUS — normal_5fc1d916b50ae.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: be3b5677c9b2d007476e0b52400a6a7f3b19e90ac4f577195335aac4cac59a81
SHA-1: 73c9898a741f81fb27e2c27eac69881b351ae441
MD5: 22b64d9baa78952341b3a0a1226643e4
ssdeep: 1536:a3z9ydUv0cPxeh7OvaPL1JnRqpMUkmOUuYfOD:yoMP0hgarRqpMUgzYG
TLSH: T14136BEF3716BDD8C26C56B036A6558B571C9D2DCB420A6504E81BB2CE0EB3BD3E31A11
Submitted as: normal_5fc1d916b50ae.pdf
File type: pdf · Size: 68946 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Contacted 20 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/0a981334-f569-41d9-928b-df8811e932b1/isla_nublar_discord.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://cctraff.ru/123?utm_term=nursing+2020+drug+handbook+pdf+free, https://denasigetul.weebly.com/uploads/1/3/4/3/134332190/purudokuvag-fibulezazaf-lomipupokape.pdf, https://uploads.strikinglycdn.com/files/0a981334-f569-41d9-928b-df8811e932b1/isla_nublar_discord.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9842 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
desktop-hsgcbep
250.255.255.239.in-addr.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 7fd39958fc3423db4b83c18704e5afec9c4034d4632227c7b0d262d57f102321
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\6a44c193f57ee5c9e27d0b5ec4002d16.png - aca6a00fc23c519f0288d4d6c27a09139f24186813e7b21844a9d339c7a4b487
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://cctraff.ru/123?utm_term=nursing+2020+drug+handbook+pdf+free
https://denasigetul.weebly.com/uploads/1/3/4/3/134332190/purudokuvag-fibulezazaf-lomipupokape.pdf
https://uploads.strikinglycdn.com/files/0a981334-f569-41d9-928b-df8811e932b1/isla_nublar_discord.pdf
https://debexubomes.weebly.com/uploads/1/3/4/8/134881130/3685019.pdf
https://s3.amazonaws.com/bokelur/57461055545.pdf
https://s3.amazonaws.com/daselex/givasopidus.pdf
https://poxesogu.weebly.com/uploads/1/3/4/8/134854809/6093569.pdf
https://poxanopa.weebly.com/uploads/1/3/4/3/134380657/wojasegowaz_niwug_gawurunokili_lezozub.pdf
https://botubadixebom.weebly.com/uploads/1/3/1/4/131407995/5613982.pdf
https://s3.amazonaws.com/vaxebisapesi/69813976865.pdf
https://s3.amazonaws.com/pokixovuxik/godzilla_vs_king_ghidorah_full_movie.pdf
https://uploads.strikinglycdn.com/files/186de459-1fb4-41f4-a993-ff42173ab746/makevujepidabexekaran.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787752750&P2=404&P3=2&P4=OsO6a08jtTcaOEANhLEzTOXwKbKn1WbRuZrWphDKv9Psyhe4kGOUMMJDo%2bb64GER7NBx52lIFpwbSnEjMXo5bg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787752813&P2=404&P3=2&P4=MWDF1BGD2jkKPx%2f9nhEVpySjgY0iIyg5LNKpHJHl61rlxVOymG%2fvpsJ6OB7fDr6JO1btLI0qJ1erw%2bjQWAhGWA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

cctraff.ru
denasigetul.weebly.com
uploads.strikinglycdn.com
debexubomes.weebly.com
s3.amazonaws.com
poxesogu.weebly.com
poxanopa.weebly.com
botubadixebom.weebly.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

13.89.179.15
20.184.175.20
135.232.92.34
4.230.171.124
72.154.7.16
203.26.79.13
4.155.95.136
135.232.92.97
20.236.44.162
20.165.94.63
52.123.128.14
20.184.175.22
20.50.201.205
135.232.92.137
172.178.240.163
52.123.252.194
20.165.94.46
92.223.78.30
172.217.25.195
20.42.179.192

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report