MALICIOUS — 21473661561.pdf

MALICIOUS — 21473661561.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (72/100). 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: c669e20856c25a8e811429ddc919a63dadd8e2b99f1db4a2016923fca8b13d4e
• SHA-1: 30706681d995fd0a0f49ddc9b28a3e6dc548f8bb
• MD5: bc51ef9a7f49bcd2bdbc92c4ce4ea867
• ssdeep: 1536:+GFrixanZ98ccG+6GpUobk775aJIHhTESJbhFaKyjtBpLIb5qmkVgjb9:nFrtnfVGp3bMAJIHhTlDFaK0BKbsV0
• TLSH: T1BF37D0F31167EE4C6EA35B537DB626986191838C3233977019887E6C88BC2BC7F01961
• Submitted as: 21473661561.pdf
• File type: pdf · Size: 71126 bytes
• Verdict: malicious (72/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

• T1105
• T1566.002

Why this verdict

The malicious score of 72/100 is the fusion of 6 weighted signals:

• Contacted 18 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
• Embedded link rated suspicious by URL analysis: http://dukolabe.tiffanyphillipsrn.com/uploads/1/3/1/0/131070381/zakuwavomarafa-jirowumijenajix.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=absorcion+de+las+vitaminas+liposolubles+pdf, http://files.upygeo.com/uploads/1/3/2/6/132682646/sarolimofubisena.pdf, http://dukolabe.tiffanyphillipsrn.com/uploads/1/3/1/0/131070381/zakuwavomarafa-jirowumijenajix.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

10248 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• ntp.ubuntu.com
• 250.255.255.239.in-addr.arpa
• desktop-hsgcbep
• desktop-hsgcbep._dosvc._tcp.local
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

• C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\d5686089449162c40f945e66e94a5a88.png - abdfb112113b53122bf2ebae0d86c201348dc21a60c47454b6ecb168e71fb274
• C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - ccaacb8fa8537149b43f0ff8aaff4b2026d0e57385e95dd93d86e3e16a835bb7
• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://ggtraff.ru/strik?keyword=absorcion+de+las+vitaminas+liposolubles+pdf
• http://files.upygeo.com/uploads/1/3/2/6/132682646/sarolimofubisena.pdf
• http://dukolabe.tiffanyphillipsrn.com/uploads/1/3/1/0/131070381/zakuwavomarafa-jirowumijenajix.pdf
• http://sarusuj.thehomegirltherapist.com/uploads/1/3/1/4/131406071/rugidapofis.pdf
• http://files.myvitalessentials.com/uploads/1/3/0/8/130874180/sevubufukazisi.pdf
• http://topafij.marquettecd.com/uploads/1/3/0/9/130969422/4567322.pdf
• http://logivuwe.maximvsprophet.com/uploads/1/3/2/6/132695356/8263081.pdf
• http://files.ninosfamilyrestaurant.net/uploads/1/3/0/9/130969172/6982500.pdf
• http://files.larrymcd.com/uploads/1/3/0/8/130814177/7253914.pdf
• http://silitof.fayephotographyblackpool.co.uk/uploads/1/3/1/8/131857590/7184037.pdf
• http://files.shackboldon.com/uploads/1/3/0/9/130969497/didelalizijejebo.pdf
• http://files.unboundmint.com/uploads/1/3/2/6/132681763/zivilozinenasogor.pdf
• http://files.zootzies.com/uploads/1/3/2/3/132303282/tirepeneni.pdf
• http://files.inganamort.com/uploads/1/3/0/7/130776603/2356190.pdf
• http://files.n-trax.com/uploads/1/3/0/7/130775306/8373526.pdf
• http://sijima.thestringninja.com/uploads/1/3/2/6/132682006/pezuziwifogikajuba.pdf
• http://nagejexom.swswa.org/uploads/1/3/2/7/132741194/biviputasokosasoris.pdf
• http://xovoki.metricsconstruction.com/uploads/1/3/0/7/130775734/niteno.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/
• http://www.msftconnecttest.com/connecttest.txt

Embedded domains

• ggtraff.ru
• files.upygeo.com
• dukolabe.tiffanyphillipsrn.com
• sarusuj.thehomegirltherapist.com
• files.myvitalessentials.com
• topafij.marquettecd.com
• logivuwe.maximvsprophet.com
• files.ninosfamilyrestaurant.net
• files.larrymcd.com
• silitof.fayephotographyblackpool.co.uk
• files.shackboldon.com
• files.unboundmint.com
• files.zootzies.com
• files.inganamort.com
• files.n-trax.com
• sijima.thestringninja.com
• nagejexom.swswa.org
• xovoki.metricsconstruction.com
• www.w3.org
• purl.org
• ns.adobe.com

Embedded IP addresses

• 172.172.255.218
• 20.165.94.46
• 20.42.73.31
• 74.178.76.128
• 20.247.184.142
• 48.211.4.16
• 4.230.171.124
• 135.233.95.144
• 74.179.77.164
• 20.231.239.246
• 52.123.129.14
• 52.178.17.233
• 74.179.71.159
• 203.26.79.13
• 135.234.160.244
• 4.150.223.99
• 20.50.201.205
• 142.250.183.35

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report