MALICIOUS — normal_5fe071a1d923d.pdf

MALICIOUS — normal_5fe071a1d923d.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: eb570fd23205c8c288cfb081e0a2c59cbc5d5c05e437fef26ea94146eeec4e4f
SHA-1: 22bfdb74ee47766ca005b77c024073c11549c339
MD5: a9acc161c22c6460dffeb3349fa7b0b0
ssdeep: 1536:l0ARj8jzm8fISesRel/TySj2T9e2AxtbFLoKLTzw+M9nCTXpeSObQDShmWjJ1Bw/:+ARYjzJeJ5q5FAxthL/9YnbSOk9WjJ18
TLSH: T10C38E1E365D3FC4CA5C7A7839CF3251C74C8E68A21B397B44448A69CC4B856DAE90F42
Submitted as: normal_5fe071a1d923d.pdf
File type: pdf · Size: 81645 bytes
Verdict: malicious (95/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 95/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 18 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://traffmen.ru/123?utm_term=nautical+ceiling+fans, https://static1.squarespace.com/static/5fbffcc36609fd0ee78c2f31/t/5fc12cf82dd96f591819e116/1606495480861/ender_lily_farm_1.12.pdf, https://jegobagugixados.weebly.com/uploads/1/3/4/8/134858953/jafodiramopenod_ruzobisef_kasofilu_tewibutukafugad.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9727 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
79.243.254.169.in-addr.arpa
255.255.254.169.in-addr.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\921faf3f08412c8fdf3228fcccac68e2.png - ac6a713ca18874f279dde2a1f165259e2e3a07c3eeaf6253b663736229b334aa
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - ad2baa481ff215582c22ce33c34791d1b962cf01d838fbb8281175a43b1c412a
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://traffmen.ru/123?utm_term=nautical+ceiling+fans
https://s3.amazonaws.com/vukusa/17066049856.pdf
https://static1.squarespace.com/static/5fbffcc36609fd0ee78c2f31/t/5fc12cf82dd96f591819e116/1606495480861/ender_lily_farm_1.12.pdf
https://jegobagugixados.weebly.com/uploads/1/3/4/8/134858953/jafodiramopenod_ruzobisef_kasofilu_tewibutukafugad.pdf
https://static1.squarespace.com/static/5fc71b81849d1727bc10aae0/t/5fd13f205a35a86a4753d4ba/1607548706220/kewosakaj.pdf
https://static1.squarespace.com/static/5fc0f19a27a199023ab591db/t/5fcde0718a55f2188b99eb2d/1607327858924/7235264012.pdf
https://lakiregatu.weebly.com/uploads/1/3/4/5/134589313/fevugufikekujem.pdf
https://jivixetikuzi.weebly.com/uploads/1/3/4/7/134745571/febinugig.pdf
https://falumegobe.weebly.com/uploads/1/3/4/7/134702986/zafojolunip_gawiz_gugimikixemo_rojijurutukud.pdf
https://s3.amazonaws.com/vifusupegiza/pozewuzit.pdf
https://vonorakukipi.weebly.com/uploads/1/3/4/7/134721252/4b5f5b6f6df5b2.pdf
https://static1.squarespace.com/static/5fc14df88ef7301f8b137930/t/5fca86e38e8fba586e630494/1607108324759/40451095024.pdf
https://zipexozinapewew.weebly.com/uploads/1/3/4/3/134339437/pagujafew_suxoduzubanem.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787736969&P2=404&P3=2&P4=P323sPgu9%2bBd1fQAsTzT3dJWcKfU%2fwwt4jNKAY35ZPiFHuLKL8gCOBSM45%2fZASkrUKmNMnbPPNpL%2ftsffxbSKg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

traffmen.ru
s3.amazonaws.com
static1.squarespace.com
jegobagugixados.weebly.com
lakiregatu.weebly.com
jivixetikuzi.weebly.com
falumegobe.weebly.com
vonorakukipi.weebly.com
zipexozinapewew.weebly.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

20.184.175.19
52.182.141.63
92.223.78.30
104.208.16.94
48.211.4.16
4.230.171.124
4.144.132.223
20.52.64.201
135.233.95.144
52.123.128.14
135.233.45.223
74.178.76.44
203.26.79.13
52.123.252.218
135.234.160.244
48.200.63.27
52.168.117.170
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report