MALICIOUS — vuxowud.pdf

MALICIOUS — vuxowud.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (72/100). 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: e34b5de42a7b0fd3a2c99693c771fae53956a101d812820cc32315b030b6a457
SHA-1: 86b8fb61717925c39766bc4ff4b458dc8701f6c6
MD5: 028c0629da3e58f722ff91e9c93c255f
ssdeep: 768:6gGzpD0WrWGCJG9yMIUz0JEmmMewFShHtV30uZbzrTMM:nGFwWZmmLwFSBtV30OzrTMM
TLSH: T19D319FF714A7EC8C2ACB9F43ADE62154A18AD388223297B15589767CD1BC6FD5F40830
Submitted as: vuxowud.pdf
File type: pdf · Size: 41119 bytes
Verdict: malicious (72/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 72/100 is the fusion of 6 weighted signals:

Contacted 18 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/4ce3c2fc-bf7f-4516-a64f-5d5df39dc455/tukoximaduguk.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://ggtraff.ru/strik?keyword=definite+and+indefinite+articles+worksheets+pdf, https://uploads.strikinglycdn.com/files/4ce3c2fc-bf7f-4516-a64f-5d5df39dc455/tukoximaduguk.pdf, https://uploads.strikinglycdn.com/files/36f90334-3a98-46f0-b5bc-18ebb5d90c7a/manuxinilajuxebup.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9698 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
desktop-hsgcbep
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787778774&P2=404&P3=2&P4=ZD2ifkRsLda3c2bm2jXV%2bkXfqrdITFdaaAg7zEozyDkLu9o50b4DUPXxA21V%2f%2bcRDC3eM7bTmWDKcjMESAq3pA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787778833&P2=404&P3=2&P4=I03kzYl7Uzyu8rEhvaRtQTJYMEaTlafTktH%2fBLH0PuefqUcnIkV1EfRDKqHza3YJkA%2fbd%2fFBcXMNi9h%2bNzne2g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 0c09977723c8c08ed94ddf958830e72cda4dd7df3e7e4777864b71ae6aa4875b
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\3184193c2bc0e72f8c348bbd303c842f.png - 68ffad44d6f895c577498c9ba020dac27547c326b342a92ff58e2580738e8a22
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://ggtraff.ru/strik?keyword=definite+and+indefinite+articles+worksheets+pdf
https://uploads.strikinglycdn.com/files/4ce3c2fc-bf7f-4516-a64f-5d5df39dc455/tukoximaduguk.pdf
https://uploads.strikinglycdn.com/files/36f90334-3a98-46f0-b5bc-18ebb5d90c7a/manuxinilajuxebup.pdf
https://uploads.strikinglycdn.com/files/f009c52e-1497-435e-a372-6877416c5c87/kekinowowabazakepogebaf.pdf
http://files.bethpoultney.com/uploads/1/3/2/7/132740352/9530147.pdf
http://nolod.reneebolinger.com/uploads/1/3/1/4/131437462/fumajulabosip_wuboti_senumul.pdf
http://jixaxen.osseocommunitychurch.com/uploads/1/3/0/7/130776433/7014922.pdf
http://zoxopubes.evanselectric.net/uploads/1/3/1/6/131636612/bumewaf.pdf
http://gizodi.jesslyonphotography.com/uploads/1/3/1/3/131380345/zitakawabuwixas.pdf
http://wizixagu.clovercreekaerodrome.net/uploads/1/3/1/0/131070604/bevef.pdf
http://files.movemoreeathealthy.org/uploads/1/3/0/7/130739444/piwiweruga-kukixogarobuwor-jitipas.pdf
http://files.barn4art.com/uploads/1/3/1/4/131437775/vesolakosabop.pdf
http://files.ashtabulafair.com/uploads/1/3/1/4/131437728/pedubiwe_fiferokarat_sasulewatirov.pdf
https://site-1038391.mozfiles.com/files/1038391/26757604920.pdf
https://site-1036644.mozfiles.com/files/1036644/belukotororusexumal.pdf
https://site-1037881.mozfiles.com/files/1037881/ritenobar.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

ggtraff.ru
uploads.strikinglycdn.com
files.bethpoultney.com
nolod.reneebolinger.com
jixaxen.osseocommunitychurch.com
zoxopubes.evanselectric.net
gizodi.jesslyonphotography.com
wizixagu.clovercreekaerodrome.net
files.movemoreeathealthy.org
files.barn4art.com
files.ashtabulafair.com
site-1038391.mozfiles.com
site-1036644.mozfiles.com
site-1037881.mozfiles.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

85.210.196.11
172.172.255.217
4.150.223.106
52.123.252.197
52.110.12.47
52.110.12.38
4.230.171.124
52.230.60.54
4.150.223.111
20.76.201.171
20.165.94.63
52.123.129.14
40.99.133.226
72.153.5.129
203.26.79.13
92.223.78.30
142.250.207.3
48.200.63.27

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report