MALICIOUS — normal_5fdabe7116e3b.pdf
MALICIOUS — normal_5fdabe7116e3b.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
edf2e1dff6b949387f7eaf5f98102e2e85f7c1099d3ea3159050541f5784eaeb - SHA-1:
8bbe3f4e7a9bee7a6655b2abcf696094798f7a4f - MD5:
d84c18c2ba9e0fd4b5044f773e6a9f2b - ssdeep:
1536:UhYdGQsve+Rm37x5VRHC5jHAxYfGJP+/d1xFVTQs7SjV9mpsMEYx/wo8JD:0Vfm9RlaGE7SZ9mubY1fG - TLSH:
T11E37D0E72157DD4D77825F63AEA2291C6089D7886427C2B180C8BA2DC4BC7ED7E25B10 - Submitted as: normal_5fdabe7116e3b.pdf
- File type: pdf · Size: 70216 bytes
- Verdict: malicious (98/100)
Detections (4 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 7 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4410217/normal_5fc4cc9cd6297.pdf - network signal, weight 0.70, confidence 0.80
- Contacted 14 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://gettraff.ru/123?utm_term=the+mythical+creatures+bible+pdf, https://cdn-cms.f-static.net/uploads/4379733/normal_5f8aa1b5416a9.pdf, https://static.s123-cdn-static.com/uploads/4410217/normal_5fc4cc9cd6297.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Extracted generic config (9 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
9794 behavior events · 0 ATT&CK techniques · 3 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- c.pki.goog
- desktop-hsgcbep
- ntp.ubuntu.com
- WORKGROUP
- 250.255.255.239.in-addr.arpa
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- http://www.msftconnecttest.com/connecttest.txt
Dropped files
- C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt -
1d49ef79a40190601f42a356ba56b7c95814034f5e6f3159db0208e4228026aa - C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\643a29ce617ecceb1187ac6a602a017a.png -
e74ce1f7d30a80d0a9d06c4f38282be7e42ce8a1da009d86a5e1c89e4097668c - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://gettraff.ru/123?utm_term=the+mythical+creatures+bible+pdf
- https://cdn-cms.f-static.net/uploads/4379733/normal_5f8aa1b5416a9.pdf
- https://static.s123-cdn-static.com/uploads/4410217/normal_5fc4cc9cd6297.pdf
- https://uploads.strikinglycdn.com/files/8bef6930-84cf-42ef-adfe-98952358d808/secrets_of_grindea_mods.pdf
- https://cdn-cms.f-static.net/uploads/4367668/normal_5f8ba3da1159f.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd0aaf29c5e26690277b25/1606224559562/94335171561.pdf
- https://uploads.strikinglycdn.com/files/f8fa0023-3bcc-49be-8a94-710469eabe8e/gigidibawadiwe.pdf
- https://mawosamaretezij.weebly.com/uploads/1/3/4/8/134860838/487aeb58ecd4c2.pdf
- https://static1.squarespace.com/static/5fc0e2740a2757459be2c9b8/t/5fc5654deaf37e3b6451e2ee/1606772046114/75398585027.pdf
- https://static.s123-cdn-static.com/uploads/4402944/normal_5fc75f4ce0e1f.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe06dc6457125654011377/1606289116753/toledo_oh_sex_trafficking.pdf
- https://static1.squarespace.com/static/5fc673d711f6a41984abc1e0/t/5fd15ea2871f8c6e594de278/1607556771033/21296867800.pdf
- https://cdn-cms.f-static.net/uploads/4470408/normal_5fd23355c5bd0.pdf
- https://static1.squarespace.com/static/5fc55cc72e34347c7062119a/t/5fd74fff13a48350e82f1e01/1607946239440/75104431071.pdf
- https://cdn-cms.f-static.net/uploads/4373987/normal_5f8f56285f155.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
Embedded domains
- gettraff.ru
- cdn-cms.f-static.net
- static.s123-cdn-static.com
- uploads.strikinglycdn.com
- static1.squarespace.com
- mawosamaretezij.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Embedded IP addresses
- 20.42.179.192
- 52.110.12.31
- 4.230.171.124
- 74.178.240.61
- 135.232.92.97
- 20.76.201.171
- 52.123.128.14
- 40.99.133.226
- 20.165.94.46
- 203.26.79.13
- 142.250.195.131
- 4.150.223.97
- 4.209.250.170
- 51.105.71.136
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report