MALICIOUS — paxaliju.pdf

MALICIOUS — paxaliju.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (72/100). 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: c8be090aaf296a5c65a2326c2c0dca62d5aa8222e1d5c1ebb9541d8e9c516f9a
• SHA-1: 326ad7dc23dfdc1dab1f6d87293c906abee7afaa
• MD5: 5f935e0a0eda270fc4ce79365aece9b4
• ssdeep: 1536:ZGFMI67zY4Y1uMSQYC4VN+KgtIzQxAqCiIbL4eq:sFMI6fY4Y1uMG0hxRHIb6
• TLSH: T1D034AEF310ABED4C7A87AB936CE60899B49AC2C97136576008D8766CC4BC3FD5F10961
• Submitted as: paxaliju.pdf
• File type: pdf · Size: 53726 bytes
• Verdict: malicious (72/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

• T1105
• T1566.002

Why this verdict

The malicious score of 72/100 is the fusion of 6 weighted signals:

• Contacted 20 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
• Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/f0e13d07-5f07-42aa-8611-9170c2efa349/dilovoxolazosetufo.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://gettraff.ru/strik?keyword=exercice+corrig%25C3%25A9+algorithme+les+tableaux+pdf, https://cdn.shopify.com/s/files/1/0431/0797/5335/files/360_root_apk_android_6._0_1.pdf, https://cdn.shopify.com/s/files/1/0437/3273/0008/files/oracle_virtualbox_for_linux_ubuntu.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Extracted generic config (12 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9791 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• c.pki.goog
• desktop-hsgcbep
• ntp.ubuntu.com
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Dropped files

• C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - d4aa5bdb229b263e0d926893081c03342d8ff0ac288a42175b986508ce4be82b
• C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\39723ffaa103f232d3ce83e358d1a66e.png - 341b5c9188c25fe7b3cc969b8252bcab397b9647cda54fed3fcac341106e116f
• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://gettraff.ru/strik?keyword=exercice+corrig%25C3%25A9+algorithme+les+tableaux+pdf
• https://cdn.shopify.com/s/files/1/0431/0797/5335/files/360_root_apk_android_6._0_1.pdf
• https://cdn.shopify.com/s/files/1/0437/3273/0008/files/oracle_virtualbox_for_linux_ubuntu.pdf
• https://cdn.shopify.com/s/files/1/0432/3740/8936/files/83672907308.pdf
• https://cdn.shopify.com/s/files/1/0483/0189/9931/files/auction_house_wow_classic.pdf
• https://cdn.shopify.com/s/files/1/0431/8055/6452/files/canzoniere_con_accordi_per_chitarra.pdf
• http://files.prezziessugarloaf.com/uploads/1/3/1/6/131606537/7323635.pdf
• http://files.education-projects.com/uploads/1/3/1/6/131637806/9f9ef2a3.pdf
• https://uploads.strikinglycdn.com/files/f0e13d07-5f07-42aa-8611-9170c2efa349/dilovoxolazosetufo.pdf
• https://uploads.strikinglycdn.com/files/c0a84b15-42dc-4f8b-b477-f80a2aa35a1f/nunuduwodopi.pdf
• https://uploads.strikinglycdn.com/files/78f90eee-e51e-4bf7-9a99-95cbe22e1fdb/40798671496.pdf
• https://uploads.strikinglycdn.com/files/6382d760-dd03-4758-8234-3fecda4ebf46/62924072658.pdf
• https://uploads.strikinglycdn.com/files/56b808ff-8060-483b-a48c-8a38e5216502/32640774143.pdf
• http://files.stjohncontemplativesisters.com/uploads/1/3/1/4/131406036/kefisa.pdf
• http://files.dragoneyecreations.com/uploads/1/3/1/0/131070407/zoxari.pdf
• http://ripiwemol.weaversmc.org/uploads/1/3/1/3/131379803/99dcb38cbc26d.pdf
• http://files.orioleadvocates.org/uploads/1/3/1/4/131453274/2ccd4eed9.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Embedded domains

• gettraff.ru
• cdn.shopify.com
• files.prezziessugarloaf.com
• files.education-projects.com
• uploads.strikinglycdn.com
• files.stjohncontemplativesisters.com
• files.dragoneyecreations.com
• ripiwemol.weaversmc.org
• files.orioleadvocates.org
• www.w3.org
• purl.org
• ns.adobe.com

Embedded IP addresses

• 85.210.196.11
• 172.172.255.217
• 20.42.65.89
• 52.123.252.194
• 52.110.12.40
• 85.210.193.152
• 4.230.171.124
• 52.253.84.76
• 104.208.16.94
• 20.76.201.171
• 74.178.76.128
• 52.123.129.14
• 72.145.35.100
• 203.26.79.13
• 74.179.71.159
• 142.250.207.3
• 48.200.63.27
• 52.123.128.14
• 172.172.255.216
• 52.123.252.213

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report