MALICIOUS — surogedopomizizofilinew.pdf
MALICIOUS — surogedopomizizofilinew.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (72/100). 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
ee108f199acbaa60c57f8841a79a96ca19bbbf68495cf89506c4c79c4ec03baa - SHA-1:
072a169510842532f18c9737e801da0f566ca749 - MD5:
5b8f13dbd9d5484ce3e7cd2fa8548d42 - ssdeep:
768:NgGzpDalKwNqlB3pfXsFONTSP+4I4gbvLh63uAwfW1SOl0w:uGFOYgq73egI7gbvLh63uAwLOl0w - TLSH:
T104329EF71073FD8C7A8ABB0369EA1199644AD74921769B7004CC7B2CC0BC6BD7E50A61 - Submitted as: surogedopomizizofilinew.pdf
- File type: pdf · Size: 43798 bytes
- Verdict: malicious (72/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
MITRE ATT&CK
Why this verdict
The malicious score of 72/100 is the fusion of 6 weighted signals:
- Contacted 18 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/9b122074-c119-4ea6-ac41-2e68fa45aba4/witufividupipofizituri.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://cctraff.ru/strik?keyword=mepilex+border+heel+pdf, https://uploads.strikinglycdn.com/files/9b122074-c119-4ea6-ac41-2e68fa45aba4/witufividupipofizituri.pdf, https://uploads.strikinglycdn.com/files/9fdff0c2-cebc-432e-895b-bb75560f23c5/buwofusizeludujikajeligi.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
9657 behavior events · 0 ATT&CK techniques · 3 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ntp.ubuntu.com
- desktop-hsgcbep
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787780357&P2=404&P3=2&P4=SoKlpyIx7PX0PWYaZmGr3QeDp%2f23jbeMm5KQrxkW1CLMFGNogALZzJVNuAvcCVPIMJVJilWiwgEtf118VaLnqQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787780418&P2=404&P3=2&P4=RFoiPbICJao6F6r48%2bdxXjnGtvghSyy42l34tCVKvEGAA4EGkK8hPyoKA6cnDb4ujqgLj%2bAAIPb86hxo3bednw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- 23.40.52.209
Dropped files
- C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt -
52bd5603b470caa67c369296be0031150786aa4108a14acc660929ff84057c59 - C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\c2d9ba856731d9607f3fefa3e84fb4ff.png -
a854bf9b72da16b6e1ef1a8a90fa485a845c2b8aebe38440b77aa8a0ed50432d - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://cctraff.ru/strik?keyword=mepilex+border+heel+pdf
- https://uploads.strikinglycdn.com/files/9b122074-c119-4ea6-ac41-2e68fa45aba4/witufividupipofizituri.pdf
- https://uploads.strikinglycdn.com/files/9fdff0c2-cebc-432e-895b-bb75560f23c5/buwofusizeludujikajeligi.pdf
- https://uploads.strikinglycdn.com/files/907ab86f-f0b7-4ba9-aaf1-2a87af321995/masagijerut.pdf
- https://uploads.strikinglycdn.com/files/85277d48-3bf0-4dee-a77f-a35f0375a067/firofexolasovuk.pdf
- https://site-1036713.mozfiles.com/files/1036713/mixavademu.pdf
- https://site-1038375.mozfiles.com/files/1038375/koresuwovopuzib.pdf
- https://site-1036920.mozfiles.com/files/1036920/45159305228.pdf
- https://site-1036665.mozfiles.com/files/1036665/komega.pdf
- https://site-1036695.mozfiles.com/files/1036695/20013763140.pdf
- https://cdn.shopify.com/s/files/1/0431/6535/2093/files/26482810410.pdf
- https://cdn.shopify.com/s/files/1/0436/0149/4179/files/fefew.pdf
- https://cdn.shopify.com/s/files/1/0430/6914/5241/files/descargar_mp3_conjunto_primavera.pdf
- https://cdn.shopify.com/s/files/1/0428/6873/6166/files/nererefekoberuvagol.pdf
- https://uploads.strikinglycdn.com/files/9458de5d-13c7-4f18-9ca8-fffb31ab6e69/jaxigetalabu.pdf
- https://uploads.strikinglycdn.com/files/1f08066e-afbe-4a70-bfb1-d264373952aa/23028711124.pdf
- https://uploads.strikinglycdn.com/files/b1a2f300-3bd6-4e88-98c1-93a2d3f406f1/70310630907.pdf
- https://uploads.strikinglycdn.com/files/65f6f33a-a725-46d7-b682-f6d330118696/gifaso.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://www.msftconnecttest.com/connecttest.txt
Embedded domains
- cctraff.ru
- uploads.strikinglycdn.com
- site-1036713.mozfiles.com
- site-1038375.mozfiles.com
- site-1036920.mozfiles.com
- site-1036665.mozfiles.com
- site-1036695.mozfiles.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Embedded IP addresses
- 4.150.223.96
- 52.123.252.215
- 20.42.179.192
- 52.110.12.48
- 4.230.171.124
- 52.230.60.54
- 20.165.94.63
- 74.178.240.51
- 40.99.133.226
- 52.123.129.14
- 72.153.5.134
- 203.26.79.13
- 135.233.45.223
- 52.123.252.242
- 48.211.4.16
- 20.42.73.25
- 172.178.240.161
- 52.148.114.188
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report