MALICIOUS — 7e0eb0_58e15daaaf29415cba2d038f1e781d90.pdf
MALICIOUS — 7e0eb0_58e15daaaf29415cba2d038f1e781d90.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
dab8894b8c585f11b4d838e73b4be6242ca9e77507123fe7c10922bc7118c4ec - SHA-1:
3b04b44e298ddce559118917d0cfdf5677fca609 - MD5:
72b4fd1b87d7290ea883d40116538565 - ssdeep:
768:rgGzpDre8ESYPpIvA4GsNlcEAqBa2B66WALszEqjx7gHaQPg58ihpuWQ/EviG:UGFXBA4GsfX9wq6sy7gNZihk7SiG - TLSH:
T102319DF3506BEC4CBA86EB037DEA10595246D69CA023EB5459CC773CD5B86BDBE00920 - Submitted as: 7e0eb0_58e15daaaf29415cba2d038f1e781d90.pdf
- File type: pdf · Size: 42527 bytes
- Verdict: malicious (78/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The malicious score of 78/100 is the fusion of 5 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ttraff.me/wix?keyword=kitchenaid+service+manual, https://cdn.shopify.com/s/files/1/0428/1729/0406/files/parewazatorasupuzotirob.pdf, https://cdn.shopify.com/s/files/1/0435/4313/4362/files/mowagavamufuzefekebopixil.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
991 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- teams.cloud.microsoft
- searchapp.bundleassets.example
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- staging.to-do.officeppe.com
- m365.cloud.microsoft
- ntp.ubuntu.com
- 192.168.122.105
- 224.0.0.252
- 192.168.122.255
- 192.168.122.1
- 192.168.122.113
- 192.168.122.114
- 192.168.122.106
- 192.168.122.107
- 169.254.169.16
Dropped files
- root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://ttraff.me/wix?keyword=kitchenaid+service+manual
- https://cdn.shopify.com/s/files/1/0428/1729/0406/files/parewazatorasupuzotirob.pdf
- https://cdn.shopify.com/s/files/1/0435/4313/4362/files/mowagavamufuzefekebopixil.pdf
- https://cdn.shopify.com/s/files/1/0430/9948/8410/files/nesazutixusuj.pdf
- https://cdn.shopify.com/s/files/1/0433/9033/7189/files/22282952399.pdf
- https://4185ba4b-8c55-4116-9701-315948ae89cd.filesusr.com/ugd/c5d40f_234f1071dc364e1f9e9d6cc519be71bc.pdf?index=true
- https://f4dd203f-8e41-4e95-98a0-d76cfe617c2e.filesusr.com/ugd/544e7e_a88bafd7bbe54b58849e073618db85a1.pdf?index=true
- https://3674a1ae-fab9-4035-bb81-81f4d7e0537e.filesusr.com/ugd/c1108c_cfaeec2b5dc748888481d36fa826497d.pdf?index=true
- https://7d721fe8-3238-4f61-b4cd-0c22466065d0.filesusr.com/ugd/9374a7_9b72cd0b33654dd3ad642a595fc4e127.pdf?index=true
- https://cdn.shopify.com/s/files/1/0438/6082/0133/files/arifureta_from_commonplace_to_worlds_strongest_manga.pdf
- https://cdn.shopify.com/s/files/1/0434/0016/7589/files/48488285414.pdf
- https://cdn.shopify.com/s/files/1/0428/9481/9484/files/lutegatazexaxezoxu.pdf
- https://cdn.shopify.com/s/files/1/0432/2246/6720/files/nivapewexetowazika.pdf
- https://cdn.shopify.com/s/files/1/0428/5107/4214/files/34837608525.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ttraff.me
- cdn.shopify.com
- 4185ba4b-8c55-4116-9701-315948ae89cd.filesusr.com
- f4dd203f-8e41-4e95-98a0-d76cfe617c2e.filesusr.com
- 3674a1ae-fab9-4035-bb81-81f4d7e0537e.filesusr.com
- 7d721fe8-3238-4f61-b4cd-0c22466065d0.filesusr.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report