MALICIOUS — 64811104289.pdf

MALICIOUS — 64811104289.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (72/100). 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: d80bba59e16edad7ee7b2d52a0f5e985a8bb2841fceed8141c0eecc238d4e500
SHA-1: e3029e43ece911ca545702c84bbde547b8f746d9
MD5: cf94d2c4b18af3b3f27e44bb06bafed9
ssdeep: 768:ggGzpDSptOKMAoSlgBWoN5kvwvfaSP9CVYQZOcOt8ncOgOSL:tGFep4zWoDkovfi+2ncObSL
TLSH: T10D308EF3449BED8C76CA6B03AEA7114A204AD38D7033E6A055C8763DD47C5FD2E10A61
Submitted as: 64811104289.pdf
File type: pdf · Size: 36630 bytes
Verdict: malicious (72/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 72/100 is the fusion of 6 weighted signals:

Contacted 20 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/9dd1f216-0bea-48cb-95b5-63ba8f57812b/30097644102.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://ggtraff.ru/strik?keyword=manual+post+hole+digger+mitre+10, https://cdn.shopify.com/s/files/1/0433/7811/4727/files/litogegubo.pdf, https://cdn.shopify.com/s/files/1/0483/4610/3959/files/directions_to_ohare_airport_pickup.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (8 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9858 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep._dosvc._tcp.local
ntp.ubuntu.com
desktop-hsgcbep
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787774494&P2=404&P3=2&P4=gpIwbNVUcsBby235F72RxeKTuKwRwMIb0t03EbUkh68rRAaxtNEPjuDHL1hrSVNANykZHffXCQGij2Prk8Izyg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787774566&P2=404&P3=2&P4=RZtWtDn9CIKJP28rsw9nGFP%2ftPUilye6ENuzdE9SLWKCg8ZZ5oZJcqRZLi%2fgrCXzxESYDWCejO0DnlUKO%2bkqCQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\b071febecfa7291fdc14d951400e3ffa.png - 1b3a2c7924338b3feed7520e42947bb8e8a64a1b63fbb93b3b444844f84ffbe7
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - b41c7fabd7ad49e3c46f1e63a689254cd0a5dfc9466a5e55720bb2abbca35f90
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://ggtraff.ru/strik?keyword=manual+post+hole+digger+mitre+10
https://cdn.shopify.com/s/files/1/0433/7811/4727/files/litogegubo.pdf
https://cdn.shopify.com/s/files/1/0483/4610/3959/files/directions_to_ohare_airport_pickup.pdf
https://cdn.shopify.com/s/files/1/0432/6948/8798/files/carswell_air_force_base_directions.pdf
https://cdn.shopify.com/s/files/1/0433/3276/3801/files/321193276.pdf
https://genigudepa.weebly.com/uploads/1/3/1/0/131070712/runemevurexuziwone.pdf
https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/sidobojugonuxexoz.pdf
https://xojerajap.weebly.com/uploads/1/3/1/3/131384359/foburadip.pdf
https://mogilifus.weebly.com/uploads/1/3/0/7/130739831/8742796.pdf
https://bedizegoresupa.weebly.com/uploads/1/3/1/3/131379398/kezupukono.pdf
https://uploads.strikinglycdn.com/files/9dd1f216-0bea-48cb-95b5-63ba8f57812b/30097644102.pdf
https://uploads.strikinglycdn.com/files/a289260b-0df4-4483-9718-d4851f0eefaf/pufusenewusow.pdf
https://uploads.strikinglycdn.com/files/21c37f98-c94c-4e13-a614-189adf12d3a0/pufawiziliradomewulefo.pdf
https://uploads.strikinglycdn.com/files/fc7ed210-f664-4046-9fb0-a70e6957034f/doxifaziwewobuxav.pdf
https://uploads.strikinglycdn.com/files/d4fe610c-952f-46b9-950a-d2fd9faf5309/2119223948.pdf
https://uploads.strikinglycdn.com/files/73b26ccc-e0fe-4caa-b6e7-c317519c2bcd/89545018742.pdf
https://uploads.strikinglycdn.com/files/3e9a122f-ccf0-4d27-ad00-644e60ef55ff/79212381138.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Embedded domains

ggtraff.ru
cdn.shopify.com
genigudepa.weebly.com
dutitujazekap.weebly.com
xojerajap.weebly.com
mogilifus.weebly.com
bedizegoresupa.weebly.com
uploads.strikinglycdn.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

135.234.160.245
40.79.167.9
52.123.252.212
4.230.171.124
172.215.188.232
74.179.77.204
135.233.95.135
20.231.239.246
52.123.129.14
40.99.133.210
40.103.64.242
172.178.240.161
52.123.252.215
72.145.35.108
203.26.79.13
135.232.92.34
4.150.223.112
20.50.201.203
4.150.223.101
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report