MALICIOUS — wafudugeluv.pdf

MALICIOUS — wafudugeluv.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (72/100). 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: d6b48b9c77afb590b8fe7ab09fc7e9ced1b1d56fad0c9ba38ba223657697ac9a
SHA-1: 86f3bf5487efd5a075a1123b0ab3ba1b38910dc7
MD5: 39ceddd73d7bc4c1b657075010c373af
ssdeep: 768:EgGzpD4Gi3TB1VzPhibS5ZnmuSyOkJs7abrb8rlPEitt/cu1BjB6Z0RL:xGFkZOk/SyOTyrGlPfpB6Z0RL
TLSH: T13A34BFF31097ED8C3ACA5B475AB714A97186C7CD223696A084DC7B6CC4BC7BD6E40620
Submitted as: wafudugeluv.pdf
File type: pdf · Size: 54414 bytes
Verdict: malicious (72/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 72/100 is the fusion of 6 weighted signals:

Contacted 17 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/e810d654-1399-45fb-81b9-b55efb19bc76/20729157765.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://ggtraff.ru/strik?keyword=organic+farming+books+in+tamil+pdf, http://files.nyelaw.org/uploads/1/3/0/9/130969790/gigaloke.pdf, http://files.northernprideinspections.com/uploads/1/3/0/7/130775249/livarozi.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9638 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
desktop-hsgcbep._dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787765376&P2=404&P3=2&P4=NSL9wtY%2bonRZftD5lE%2fN%2bJKVdiW9TRTBf2xNL92tM7NIV3VgkTLhWBFu27FSm2lfAs%2b6lhzAPEb%2bLI5E6GN1jg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787765400&P2=404&P3=2&P4=HfPrxyVZhwFqDVukUXJWetjNxfpZsXuYfvpE%2fKIq8C5CmoicAVKLYwidSSf%2bwdsZBJDyaPhFLexNx23wMiCkVw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\a6f1d87dabf8b61a91971b7707d4fc45.png - abc89d9ce657fe5ce0a128383de0f6084d5623015fe47d4fc0e85e3e951140d4
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 230aaa9e139473268e9488faa0eaa7dc8afdb6a398628753348134d3290eddc2
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://ggtraff.ru/strik?keyword=organic+farming+books+in+tamil+pdf
http://files.nyelaw.org/uploads/1/3/0/9/130969790/gigaloke.pdf
http://files.northernprideinspections.com/uploads/1/3/0/7/130775249/livarozi.pdf
http://files.back40bees.com/uploads/1/3/0/9/130969580/e017b.pdf
http://terituwes.tales-trails.com/uploads/1/3/0/7/130738632/vudasupuzojaze.pdf
http://files.tungstenfishingweights.com/uploads/1/3/1/4/131483097/witiwom.pdf
https://uploads.strikinglycdn.com/files/e810d654-1399-45fb-81b9-b55efb19bc76/20729157765.pdf
https://uploads.strikinglycdn.com/files/e02dea8a-c3b9-442a-8578-aee026601d75/buxunapodutofipefonedagu.pdf
https://uploads.strikinglycdn.com/files/28bf2966-1e1d-47d1-9c83-98f7dbc7f326/tisum.pdf
https://uploads.strikinglycdn.com/files/445b30d2-24d1-48d4-8de9-1e30e4ca57c3/61075180609.pdf
https://cdn.shopify.com/s/files/1/0429/8221/1733/files/sims_4_tea_magic_personal_brewer_guide.pdf
https://cdn.shopify.com/s/files/1/0434/8212/0357/files/behavior_management_in_pediatric_dentistry.pdf
https://uploads.strikinglycdn.com/files/d17ffea5-43e7-4292-9c32-2b1e661592d6/kofagilinadalumerewologe.pdf
https://uploads.strikinglycdn.com/files/baddd4ad-3dd3-4c0d-ba24-7ef5fe847325/fujuzefedurilezuxag.pdf
https://uploads.strikinglycdn.com/files/d8037851-715b-4575-bfd4-a0b994950dca/sediku.pdf
https://uploads.strikinglycdn.com/files/a28e9400-1d75-43a0-959a-87b1240e8eb3/21209384310.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

ggtraff.ru
files.nyelaw.org
files.northernprideinspections.com
files.back40bees.com
terituwes.tales-trails.com
files.tungstenfishingweights.com
uploads.strikinglycdn.com
cdn.shopify.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

4.150.223.104
13.89.179.12
57.155.104.224
48.211.4.16
172.66.2.5
20.184.175.3
52.123.252.215
4.230.171.124
4.144.132.223
74.178.76.44
72.153.5.97
51.116.246.106
203.26.79.13
74.178.76.128
52.123.129.14
4.150.223.102
40.79.141.154

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report