MALICIOUS — normal_5faa5fa56d13c.pdf

MALICIOUS — normal_5faa5fa56d13c.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: c4a23f94a1475f2ad20be89e75470d413b0f635b92213dda61d0b84412af31dd
SHA-1: 616ea2cfb960e8d49b301610b9d545a36f54a0e9
MD5: fefff8036c6686a84513239a1084e672
ssdeep: 1536:yhvHgVDr1dmYaw0SopnLVCNEfWz3SlJT:iHgVDpYYaUcLVdi3uT
TLSH: T1CF36D1F370D7DE4C62995B93B9F67818614CC78C1132D6600989FA6CC4783BE7EA0A52
Submitted as: normal_5faa5fa56d13c.pdf
File type: pdf · Size: 67850 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 17 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/b2fae6ab-4db1-49b6-ba35-a639d1f66e18/xikuzufogakegabezib.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://traffmen.ru/123?keyword=ottoson+middle+school+arlington+ma, https://uploads.strikinglycdn.com/files/b2fae6ab-4db1-49b6-ba35-a639d1f66e18/xikuzufogakegabezib.pdf, https://uploads.strikinglycdn.com/files/04de2d61-ac2d-4e37-b23d-ecd72ee45c49/94085176873.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (6 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9687 behavior events · 1 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep._dosvc._tcp.local
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
250.255.255.239.in-addr.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\95d1d8ead86a831dfa8390c58fee3573.png - dad250241892e99b36a1a9867e35a32fe78809772f128f6679fad4c4c39f5b7a
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 88155aa5fdf1dc6ea6a365191df327dfd266bb34367fb116bd0e2a7497ad9edb
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://traffmen.ru/123?keyword=ottoson+middle+school+arlington+ma
https://s3.amazonaws.com/dinigugaxej/18425692719.pdf
https://s3.amazonaws.com/zuxadol/97256572145.pdf
https://uploads.strikinglycdn.com/files/b2fae6ab-4db1-49b6-ba35-a639d1f66e18/xikuzufogakegabezib.pdf
https://uploads.strikinglycdn.com/files/04de2d61-ac2d-4e37-b23d-ecd72ee45c49/94085176873.pdf
https://s3.amazonaws.com/dazinibonofobi/az-_400_dumps.pdf
https://s3.amazonaws.com/nuruvapozixix/dimensions_of_half_court_basketball_court.pdf
https://vajibenutiw.weebly.com/uploads/1/3/4/4/134487234/kureme.pdf
https://s3.amazonaws.com/banula/clauses_at_the_mall_answers.pdf
https://uploads.strikinglycdn.com/files/4e2307a3-7165-4bf0-b481-bc6f1c00f046/7_days_to_die_upgrade_wood_frame.pdf
https://uploads.strikinglycdn.com/files/c6acb4a4-96ff-4c5d-a6fc-5732ef60ba4d/31896974065.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787451816&P2=404&P3=2&P4=BJsVL88vbBwAwNLLrkauc6ODW9P8c4g0m3m8frXBRk%2fRKdg3PRY1qrH1FR5FdhdMtNdebaUAp7eYvgxNjarW1A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787451843&P2=404&P3=2&P4=OTgIoKOHXghAJn1ZhaE6JPA16vuuQ4EDULiI3h3%2b68NOnK4U%2fbsXNnnby3%2fAMJ5eq%2blxQDO0O4DwuEhCxCnKRw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

traffmen.ru
s3.amazonaws.com
uploads.strikinglycdn.com
vajibenutiw.weebly.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

162.159.142.9
172.172.255.217
52.178.17.2
4.150.223.105
74.178.76.44
20.247.184.142
52.110.12.38
4.230.171.124
13.69.116.109
172.66.2.5
20.165.94.63
20.112.250.133
52.123.128.14
203.26.79.13
48.192.143.121
52.168.117.175
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report