MALICIOUS — normal_5f89c16d0e6c0.pdf

MALICIOUS — normal_5f89c16d0e6c0.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (86/100). 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: e43330a33f538bd536a99fe27727d0db296c463316f50243fff329ff61bbd388
• SHA-1: 42b503590f3f79b287020b9cc83d0b45ca310535
• MD5: b4e421b4f9c15733a4af1712e5e7567f
• ssdeep: 1536:CGFnpg1SLzPxihLwSg7lkJa9uRFn8IMEbj:7FnpWSJGwSHJa9KMO
• TLSH: T13A34AFF31153ED4D3B4AAF237EEA0469624AD6897152D29418C8363CC5BC7FE7E20A11
• Submitted as: normal_5f89c16d0e6c0.pdf
• File type: pdf · Size: 55470 bytes
• Verdict: malicious (86/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

• T1105
• T1566.002

Why this verdict

The malicious score of 86/100 is the fusion of 7 weighted signals:

• Memory forensics: 3 finding(s), e.g. RWX/private injected region in SumatraPDF.exe (pid 6344) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Contacted 23 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
• Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/33fd33b7-40f6-4339-807c-2b6753388735/bolibawuziviguvijafame.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://cctraff.ru/123?keyword=la+douleur+marguerite+duras+pdf+gratuit, https://cdn.shopify.com/s/files/1/0440/1030/7749/files/razovi.pdf, https://cdn.shopify.com/s/files/1/0440/8098/8310/files/zuxibinolenedilujatido.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Extracted generic config (6 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9707 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• 250.255.255.239.in-addr.arpa
• desktop-hsgcbep
• ntp.ubuntu.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Dropped files

• C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 5a0cd56780b93615e8a9d778ee4d711851c339bd424e0b94d2800c3d32ce6514
• C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\3cf27028b2ad5dbb72a606aacd08721e.png - 049fae66eeaafddc5b6bc75efe6afefc13b5b71a05fa515dc0d6542b10af77db
• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://cctraff.ru/123?keyword=la+douleur+marguerite+duras+pdf+gratuit
• https://cdn.shopify.com/s/files/1/0440/1030/7749/files/razovi.pdf
• https://cdn.shopify.com/s/files/1/0440/8098/8310/files/zuxibinolenedilujatido.pdf
• https://cdn.shopify.com/s/files/1/0438/9548/8680/files/11089701611.pdf
• https://uploads.strikinglycdn.com/files/33fd33b7-40f6-4339-807c-2b6753388735/bolibawuziviguvijafame.pdf
• https://uploads.strikinglycdn.com/files/877197d8-23ca-468f-b13f-296134dc23ce/40325929880.pdf
• https://uploads.strikinglycdn.com/files/189d0d7a-b917-4bc2-8d80-39519a545ff2/57644648476.pdf
• https://cdn.shopify.com/s/files/1/0500/9470/2763/files/workshop_technology_machine_tools.pdf
• https://cdn.shopify.com/s/files/1/0495/5317/8791/files/ruffalo_noel_levitz_charleston_il.pdf
• https://cdn.shopify.com/s/files/1/0483/3227/5865/files/cuentos_infantiles_coreanos_en_hangul.pdf
• https://cdn.shopify.com/s/files/1/0482/2296/1816/files/best_gematria_calculator.pdf
• https://kabudededawizo.weebly.com/uploads/1/3/1/3/131383409/dupabuzalozu.pdf
• https://vevejeda.weebly.com/uploads/1/3/0/7/130776099/265bdd54fd.pdf
• https://rajomiluti.weebly.com/uploads/1/3/2/6/132682989/genizivu-winejezo.pdf
• https://cdn-cms.f-static.net/uploads/4366042/normal_5f87a76aa6587.pdf
• https://cdn-cms.f-static.net/uploads/4365607/normal_5f86f67bca788.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• cctraff.ru
• cdn.shopify.com
• uploads.strikinglycdn.com
• kabudededawizo.weebly.com
• vevejeda.weebly.com
• rajomiluti.weebly.com
• cdn-cms.f-static.net
• www.w3.org
• purl.org
• ns.adobe.com

Embedded IP addresses

• 4.207.44.68
• 172.172.255.218
• 74.178.76.128
• 40.84.85.40
• 52.168.112.67
• 135.232.92.34
• 172.66.2.5
• 20.184.175.18
• 52.110.12.46
• 52.110.12.1
• 20.247.184.142
• 4.230.171.124
• 20.165.94.54
• 20.236.44.162
• 40.99.134.18
• 52.123.128.14
• 92.223.78.30
• 135.233.95.144
• 72.154.7.112
• 203.26.79.13
• 4.150.223.115
• 51.104.15.253
• 52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report