MALICIOUS — 891219_ecb9c4e6473446d89ce632c4392ade07.pdf
MALICIOUS — 891219_ecb9c4e6473446d89ce632c4392ade07.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (80/100). 2 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
ec22c95bcaebc626037b104fcc11c7254a08a8a8d97686838e8f7034651ace32 - SHA-1:
5a3dab746345184ad7b444c4ece316a765e50ec7 - MD5:
fcd3e2b27ad7453f0d36faed856517d8 - ssdeep:
768:sgGzpDsyVS9h0NUf7RkMpW2jdncgYugSk44lHHT+NWFzlUwgG2rwG7s:pGFN275TdcgGxHlnT+NGubG20G7s - TLSH:
T10832AEF7009BDC8C3A875B175EAB10189485928E71339AB155CD7B2DC8BCABCBE41931 - Submitted as: 891219_ecb9c4e6473446d89ce632c4392ade07.pdf
- File type: pdf · Size: 44428 bytes
- Verdict: malicious (80/100)
Detections (2 of 54 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The malicious score of 80/100 is the fusion of 7 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ttraff.me/wix?keyword=white+buffalo+wish+it+was+true+meaning, https://cdn.shopify.com/s/files/1/0427/9926/8003/files/voting_ballot_template_2018.pdf, https://cdn.shopify.com/s/files/1/0434/1720/6946/files/vigijovuzadidiw.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Contacted 5 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (8 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
1087 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- searchapp.bundleassets.example
- dl.google.com
- inference.location.live.net
- teams.cloud.microsoft
- c.pki.goog
- ntp.ubuntu.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- 23.40.52.85
- 23.11.37.157
- 172.217.25.174
- 20.190.167.18
- 20.190.167.64
- 85.210.193.152 GB · London · AS8075 Microsoft Limited
- 4.144.132.114 SG · Singapore · AS8075 Microsoft Corporation
- 74.178.76.128 IE · Dublin · AS8075 Microsoft Corporation
Dropped files
- root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://ttraff.me/wix?keyword=white+buffalo+wish+it+was+true+meaning
- https://cdn.shopify.com/s/files/1/0427/9926/8003/files/voting_ballot_template_2018.pdf
- https://cdn.shopify.com/s/files/1/0434/1720/6946/files/vigijovuzadidiw.pdf
- https://cdn.shopify.com/s/files/1/0463/3372/2785/files/how_to_write_a_novel_using_the_snowflake_method.pdf
- https://a6a926c9-f4da-4609-bea3-adf52aaa9977.filesusr.com/ugd/dc6899_948cd24f8b6e4411a1771a16be2c53f3.pdf?index=true
- https://eaa2ffae-1d3f-48c5-b9fe-7bd050707496.filesusr.com/ugd/70c1ec_0a40b5d3ac80470eb4ab5aace5808cc4.pdf?index=true
- https://de2fe5f8-2ecd-4448-9da6-09840014a7d3.filesusr.com/ugd/dec231_db9bc768ac0e459c9ada9b13219dec69.pdf?index=true
- https://9c6523fd-938e-4a80-ba77-18a1776f7e4a.filesusr.com/ugd/eda9ba_255405e769be4d23b4216853ba3e8443.pdf?index=true
- https://ab2c6e00-ef30-4f04-8a33-79f0a9e38e9e.filesusr.com/ugd/4c1554_7ef394a7b2544a2aa9157d2c63ed64f8.pdf?index=true
- https://2c4032b5-2e7c-4411-9f2d-db47736c6cb8.filesusr.com/ugd/70e5f7_05c6d8d7dfee46d78f710e67b6600501.pdf?index=true
- https://db184d31-1b34-4b42-9bf8-4c173b95678f.filesusr.com/ugd/c79b1c_4bce351261344b30b24509bebe51788f.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- ttraff.me
- cdn.shopify.com
- a6a926c9-f4da-4609-bea3-adf52aaa9977.filesusr.com
- eaa2ffae-1d3f-48c5-b9fe-7bd050707496.filesusr.com
- de2fe5f8-2ecd-4448-9da6-09840014a7d3.filesusr.com
- 9c6523fd-938e-4a80-ba77-18a1776f7e4a.filesusr.com
- ab2c6e00-ef30-4f04-8a33-79f0a9e38e9e.filesusr.com
- 2c4032b5-2e7c-4411-9f2d-db47736c6cb8.filesusr.com
- db184d31-1b34-4b42-9bf8-4c173b95678f.filesusr.com
- www.w3.org
- purl.org
- ns.adobe.com
Embedded IP addresses
- 85.210.193.152
- 4.144.132.114
- 74.178.76.128
- 4.230.171.124
- 135.233.95.144
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report