MALICIOUS — moxax.pdf

MALICIOUS — moxax.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (72/100). 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: d6e70bb91194ca53ab07cfb56e957d3bd4116cd35bf342ab176a60ec72e6cafa
SHA-1: 07f833b8fbbbe94c461f6954699bde90c6e3c022
MD5: 8ecf68a74503cccb1d28c8d4ea57b276
ssdeep: 768:i0gGzpDnem2F7HTeFUFjhegjN0KSUdAJFhc8TLijjboQMX8pwRKX/8:qGFbem2XjAKPA9c7jEQbpmKX/8
TLSH: T1EE32AEF314D7DC487ACB97436DBB25A92586C7883133E7A049D87B6C847C6BD6E005A0
Submitted as: moxax.pdf
File type: pdf · Size: 44806 bytes
Verdict: malicious (72/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 72/100 is the fusion of 6 weighted signals:

Contacted 24 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://pijut.jjrrlab.com/uploads/1/3/1/4/131437728/9165246.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://gettraff.ru/strik?keyword=perception+definition+psychology+pdf, http://pijut.jjrrlab.com/uploads/1/3/1/4/131437728/9165246.pdf, http://files.danyaleducation.com/uploads/1/3/1/8/131871535/sifoxejad.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (12 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9746 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
desktop-hsgcbep
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787741718&P2=404&P3=2&P4=j7dxEUpSRh5BzR1%2fNRoaERA69hL3Du%2fs%2bKPaxQwIIFsyJTN0hNhDjJxt5tZ2cIMHos7MQWfYgTdPiHvARh0YZA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787741755&P2=404&P3=2&P4=GFUJKGvn0Zy98VZ5Gp%2bgvNwTqa1ahcRqXulsGc8g9reBn04xA%2belGUhfuWZQqruZyshtl35qysRBh%2bTsGk4O0g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\45923101b7b4526e0c3258e596f6cb8e.png - cc86c5cdc2d2b14c682835c4770459d420bccd2df6ed7b6816f3f0ad23c62f93
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 9317f9117a0e0fdb8bf4562f50a110e0cb99a35e0f54372c65fa2b07bef394f2
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://gettraff.ru/strik?keyword=perception+definition+psychology+pdf
http://pijut.jjrrlab.com/uploads/1/3/1/4/131437728/9165246.pdf
http://files.danyaleducation.com/uploads/1/3/1/8/131871535/sifoxejad.pdf
http://devofut.mountainview.gasconline.net/uploads/1/3/0/9/130969723/161018.pdf
http://files.martinheine.net/uploads/1/3/2/7/132740914/kemiwajitide.pdf
http://files.simplejoecafe.us/uploads/1/3/1/4/131437984/vikevodo_gezazup_zexewete.pdf
https://uploads.strikinglycdn.com/files/434f1be2-1238-406f-8bb7-0b0eff4cf159/55324125348.pdf
https://uploads.strikinglycdn.com/files/1a0f3f1b-0777-4806-b791-6a806916b428/fonibuxutoviritodapivas.pdf
https://uploads.strikinglycdn.com/files/6d918b53-dfc8-4512-8cd5-9e9831711582/7991500231.pdf
https://uploads.strikinglycdn.com/files/c34b4161-4ef1-4fd4-b20d-30e7f6e0ac71/65281074938.pdf
https://cdn.shopify.com/s/files/1/0496/6907/9193/files/seismic_base_shear.pdf
https://cdn.shopify.com/s/files/1/0496/0223/2484/files/66297867316.pdf
https://cdn.shopify.com/s/files/1/0486/1860/2664/files/fort_benning_combatives_level_1_handbook.pdf
https://uploads.strikinglycdn.com/files/f9706396-5f0a-46ef-8df3-b4e73d42ff37/19781767066.pdf
https://uploads.strikinglycdn.com/files/ce74cdc7-0d02-492e-9244-5a5c4886e799/28587590323.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

gettraff.ru
pijut.jjrrlab.com
files.danyaleducation.com
devofut.mountainview.gasconline.net
files.martinheine.net
files.simplejoecafe.us
uploads.strikinglycdn.com
cdn.shopify.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

74.178.76.44
20.184.175.20
51.132.193.104
52.123.252.220
52.110.12.56
40.84.85.40
4.230.171.124
135.232.92.137
4.150.223.107
20.112.250.133
52.123.128.14
40.99.134.2
20.42.73.25
135.234.160.244
52.123.252.225
72.153.5.138
203.26.79.13
52.123.252.236
74.179.71.159
57.155.101.212
52.182.141.63
4.150.223.96
52.148.114.188
142.250.195.227

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report