MALICIOUS — 53c47dd90f0088.pdf

MALICIOUS — 53c47dd90f0088.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: d5fa1fdb2edba107057fb81446d968dff188aecece2b4e46693f1d8c0eeb4606
SHA-1: 9f1610a9ced8f6939f2ca58df3d82be4c475ec74
MD5: d98ee02e967134d7355e628b1d487cec
ssdeep: 1536:z5XasbyQj7KlkdFgh6AKyTlAt09Y3F7Ww0HiZTyFXojNB5W:NLGQeRxTOqIZwYjNS
TLSH: T12337C0F360ABDCCCBA479B13B9A6102574C9D75C6131ABA481D87B7C847C2ED7E11A40
Submitted as: 53c47dd90f0088.pdf
File type: pdf · Size: 70599 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4499002/normal_5fc8cfe491938.pdf - network signal, weight 0.70, confidence 0.80
Contacted 23 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://ggtraff.ru/wb?keyword=yeezy%20static%20sizing%20guide, https://cdn-cms.f-static.net/uploads/4389352/normal_5f9c58709cf2a.pdf, https://jekazaveme.weebly.com/uploads/1/3/4/4/134470158/benejet-tinadenovomib.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (13 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9626 behavior events · 1 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
79.243.254.169.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 72521607aadf82b5a5e06f52d78892556df2ecc93a55e016ad5ccee964ee90f4
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\cc2a5280474e939bb41157c01a0a6611.png - f6508712a2c18066a5cc70d99e90a1a0ae36192bbb50cef1b0c4ac7f25fc2201
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://ggtraff.ru/wb?keyword=yeezy%20static%20sizing%20guide
https://cdn-cms.f-static.net/uploads/4389352/normal_5f9c58709cf2a.pdf
https://jekazaveme.weebly.com/uploads/1/3/4/4/134470158/benejet-tinadenovomib.pdf
https://sosufafa.weebly.com/uploads/1/3/4/8/134862430/116f355b3545ec.pdf
https://static1.squarespace.com/static/5fc0ed012e537a05ef0936a0/t/5fc4064208845d092406c637/1606682179164/wherever_you_go_there_you_are_meaning.pdf
https://s3.amazonaws.com/metubevozisul/opossum_tracks_in_snow.pdf
https://cdn-cms.f-static.net/uploads/4382618/normal_5f9128461aa26.pdf
https://cdn-cms.f-static.net/uploads/4366371/normal_5f88156b9333b.pdf
https://static.s123-cdn-static.com/uploads/4499002/normal_5fc8cfe491938.pdf
https://uploads.strikinglycdn.com/files/243eb93f-2e29-4873-aa0e-271ebcbf93c4/ralefenotowavabotusanata.pdf
https://cdn-cms.f-static.net/uploads/4410190/normal_5fc2461789c51.pdf
https://static1.squarespace.com/static/5fc0e555f7cf8c75402ae412/t/5fc7e617681da4777ac14cd9/1606936091655/walmart_vip_access_qr_code.pdf
https://tozijaletaxe.weebly.com/uploads/1/3/4/3/134312516/siserinogifu.pdf
https://static.s123-cdn-static.com/uploads/4476946/normal_5fc75ad7b9a44.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787441873&P2=404&P3=2&P4=MKwfACEp57AQ8D5zGapgS%2frY%2fLQNaKuTYTDHVqyzuqByFg0E60ki%2bmGyO1TYvb8Fq5RlgnfQay%2bE%2fbWYkb%2bGFg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ggtraff.ru
cdn-cms.f-static.net
jekazaveme.weebly.com
sosufafa.weebly.com
static1.squarespace.com
s3.amazonaws.com
static.s123-cdn-static.com
uploads.strikinglycdn.com
tozijaletaxe.weebly.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

172.172.255.217
20.42.65.91
72.154.7.104
20.42.73.28
52.123.252.248
52.123.252.240
52.110.12.21
52.110.12.38
20.42.179.192
4.230.171.124
20.247.184.197
203.26.79.13
135.232.92.97
20.236.44.162
135.233.95.144
52.123.252.218
51.116.246.106
40.104.4.2
52.123.252.194
135.233.45.223
40.103.64.226
20.184.175.23
142.250.207.3

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report