SUSPICIOUS — normal_5f8f20cfc0b7e.pdf
SUSPICIOUS — normal_5f8f20cfc0b7e.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (68/100). 1 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
c17344599a9ca49bd565b3ed2cedaa8d8b86dd6151e19ea444aed229f06e6ed2 - SHA-1:
8e3578ddc095571be649e8c80ac37eaec1aa9060 - MD5:
227b571a78bc6ad6f793f85e13519d04 - ssdeep:
768:WgGzpD7pXOJWW2cREo0obSBpoDM1UhmxU52Y2IDZ4:DGFXpiLREo0NWDM1Uhmx62IDZ4 - TLSH:
T1B4305BF701A7ED8CBE87AB43ACAB25592089C34871379760549C777C88BC66D7F10861 - Submitted as: normal_5f8f20cfc0b7e.pdf
- File type: pdf · Size: 36573 bytes
- Verdict: suspicious (68/100)
Detections (1 of 53 engines)
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 68/100 is the fusion of 5 weighted signals:
- Contacted 26 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/ce00bf00-e4f9-475f-9e05-28fd8c765753/6921235065.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://gettraff.ru/123?keyword=koc+approved+vendor+list+2020+pdf, https://uploads.strikinglycdn.com/files/ce00bf00-e4f9-475f-9e05-28fd8c765753/6921235065.pdf, https://uploads.strikinglycdn.com/files/68b6fb3f-8640-493e-bf11-65162ca62a5b/tijixilowetonenolotes.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Extracted generic config (8 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
8648 behavior events · 0 ATT&CK techniques · 2 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- licensing.mp.microsoft.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
Dropped files
- C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt -
2fa4af2143533f3c1df372beb83fc1401f7f6b82e5cb24e4e821cf24fa6f4447 - C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\dd85e96acb43a2703224e8d7986db258.png -
e53bec429776b12e4267357f008aa0b299dfb89992e463173a686209d64624e0
Embedded URLs
- https://gettraff.ru/123?keyword=koc+approved+vendor+list+2020+pdf
- https://uploads.strikinglycdn.com/files/ce00bf00-e4f9-475f-9e05-28fd8c765753/6921235065.pdf
- https://uploads.strikinglycdn.com/files/68b6fb3f-8640-493e-bf11-65162ca62a5b/tijixilowetonenolotes.pdf
- https://uploads.strikinglycdn.com/files/42492791-9dff-40c5-b2cb-d9281ff8bad0/61872531917.pdf
- https://uploads.strikinglycdn.com/files/c6ccf1c4-1774-4c6e-b599-b49371330c22/kiwofe.pdf
- https://uploads.strikinglycdn.com/files/a7d282ab-8df2-442f-bf6d-6371fd2e0975/wuvikotenufevebibosud.pdf
- https://s3.amazonaws.com/tetazino/37919257153.pdf
- https://s3.amazonaws.com/kavitokolezub/fezat.pdf
- https://s3.amazonaws.com/zetare/62430000271.pdf
- https://s3.amazonaws.com/wilugugo/37605966746.pdf
- https://s3.amazonaws.com/tadovu/zasivulabagikujowitela.pdf
- https://s3.amazonaws.com/jamokaroxoj/zozabedusomasifotozipi.pdf
- https://s3.amazonaws.com/leguvefu/24379497305.pdf
- https://s3.amazonaws.com/henghuili-files2/kemulekupejoxu.pdf
- https://s3.amazonaws.com/xanebavifamopez/3204915978.pdf
- https://s3.amazonaws.com/tetazino/libosevututoloxoti.pdf
- https://s3.amazonaws.com/zetare/fagaretupanoxuvus.pdf
- https://s3.amazonaws.com/kavitokolezub/98507179505.pdf
- https://uploads.strikinglycdn.com/files/80324f6d-bb7e-4475-addb-86601be0b868/gigel.pdf
- https://uploads.strikinglycdn.com/files/6f0dcb21-3a76-4931-bcb1-b758eb04562d/zemixifisanivum.pdf
- https://uploads.strikinglycdn.com/files/8483506c-1fcb-4583-b1e2-677259663ac0/32405594394.pdf
- https://uploads.strikinglycdn.com/files/f3ddbcf0-99b3-4238-a353-c4c28aa121ac/39859510502.pdf
- https://uploads.strikinglycdn.com/files/38814460-0d5b-452c-a6bf-86b441ac7084/e46_parts_diagrams.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- gettraff.ru
- uploads.strikinglycdn.com
- s3.amazonaws.com
- www.w3.org
- purl.org
- ns.adobe.com
Embedded IP addresses
- 52.110.12.28
- 52.110.12.5
- 203.26.79.13
- 4.150.223.101
- 52.230.59.222
- 4.230.171.124
- 40.84.85.40
- 135.233.95.144
- 4.150.223.112
- 74.178.76.54
- 20.184.175.20
- 52.123.128.14
- 20.76.201.171
- 40.99.133.242
- 52.123.129.14
- 135.234.160.246
- 74.178.232.29
- 162.159.142.9
- 52.148.114.188
- 72.154.7.16
- 52.182.141.63
- 52.168.117.170
- 20.42.179.192
- 48.192.143.121
- 52.110.12.31
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report