MALICIOUS — 14456568689.pdf

MALICIOUS — 14456568689.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (86/100). 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: d49d6d193d70b3e6a6ec54472dc7014494aa9e3c871849deaf834fcef70ef733
• SHA-1: 438c944bea4f889cbd989a0c8240e7322c28247c
• MD5: c1f542b5307215ab48762d329dfdf7cc
• ssdeep: 768:sgGzpD9n7L8jz03P/x1JHZAea9pG9PGoCF5kTR8DiP1p:pGFZ3R1JHZAe5NGoE5oRciP1p
• TLSH: T11131BFF3408BDD9C7B86BB03D9F21069659AD68C6036576058D8772CD8BCAFCAE04D21
• Submitted as: 14456568689.pdf
• File type: pdf · Size: 42005 bytes
• Verdict: malicious (86/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

• T1105
• T1566.002

Why this verdict

The malicious score of 86/100 is the fusion of 7 weighted signals:

• Memory forensics: 3 finding(s), e.g. RWX/private injected region in SumatraPDF.exe (pid 9036) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Contacted 19 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
• Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/90155e57-23c9-4cd1-9f0b-e77bc624e2f8/50600549735.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://cctraff.ru/strik?keyword=comparing+speeches+worksheet, http://files.rootsandwingsmidwifery.com/uploads/1/3/0/8/130874370/zotasilebor.pdf, http://pazoxeku.thoushaltlove.org/uploads/1/3/2/7/132740837/limijul.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Extracted generic config (7 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9704 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• 255.255.254.169.in-addr.arpa
• 79.243.254.169.in-addr.arpa
• 252.0.0.224.in-addr.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• desktop-hsgcbep
• 250.255.255.239.in-addr.arpa
• ntp.ubuntu.com
• http://www.msftconnecttest.com/connecttest.txt

Dropped files

• C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\4007f19a37a8054290dfebe44e275a0e.png - c6e8ce36e42a8722441382d29e4b2edff71d2a677ad944dfbef421983edd9cea
• C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 7568c98d146b61c4a2d7293db881f31bbc6b30bf30447bc64655f49b9304cffd
• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://cctraff.ru/strik?keyword=comparing+speeches+worksheet
• http://files.rootsandwingsmidwifery.com/uploads/1/3/0/8/130874370/zotasilebor.pdf
• http://pazoxeku.thoushaltlove.org/uploads/1/3/2/7/132740837/limijul.pdf
• http://files.hooverdamnotes.com/uploads/1/3/0/7/130776730/3556341.pdf
• https://cdn.shopify.com/s/files/1/0485/7934/6592/files/73953022957.pdf
• https://cdn.shopify.com/s/files/1/0266/9858/0145/files/king_of_fighters_99_krizalid.pdf
• https://cdn.shopify.com/s/files/1/0436/8806/7225/files/ap_environmental_science_textbook_second_edition.pdf
• https://cdn.shopify.com/s/files/1/0439/2468/4955/files/4794824088.pdf
• https://uploads.strikinglycdn.com/files/90155e57-23c9-4cd1-9f0b-e77bc624e2f8/50600549735.pdf
• https://uploads.strikinglycdn.com/files/4522faef-488d-4b23-b336-7f4e7e41b9cb/30776881872.pdf
• https://uploads.strikinglycdn.com/files/56dbc1b5-450a-4243-adfd-89edc8b9a94a/79619701769.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787740049&P2=404&P3=2&P4=MGvZKkLY7W6oL4zsDuZJ60QZkhH3D1DB%2bi0UTUP%2bkgBhtCkjbJcUdCSH8HM2qL6RHKQ1kk0f8TsPcd%2f61L8%2fLQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787740072&P2=404&P3=2&P4=cEhcdJ61kNt0oCj6K5RM794sULdkjeVrzbysYo44t6Eq%2bDYSpPB9Q3YaUMzJ8Y49gqHAUtE4HdCWT8fHnXSUdQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

• cctraff.ru
• files.rootsandwingsmidwifery.com
• pazoxeku.thoushaltlove.org
• files.hooverdamnotes.com
• cdn.shopify.com
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com

Embedded IP addresses

• 52.123.252.247
• 4.150.223.112
• 72.145.35.101
• 135.233.95.144
• 74.178.76.44
• 162.159.142.9
• 52.110.12.44
• 48.211.4.16
• 4.230.171.124
• 203.26.79.13
• 135.232.92.137
• 20.42.73.26
• 20.165.94.63
• 52.123.128.14
• 40.99.134.2
• 92.223.78.30
• 4.150.223.99
• 4.209.250.170
• 52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report