MALICIOUS — xarupogolovosopiro.pdf

MALICIOUS — xarupogolovosopiro.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (72/100). 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: f56737083550e902c4ff3f50d6213825d2c54f6576cc1dac352e93ba0e37241b
SHA-1: e670ca37a9a9ef2f25518292ec14920bca6e3a63
MD5: 419f8a5b353ebaf87095b02edd8bd0cf
ssdeep: 768:m/gGzpD4OcJxwGdZ15XRKzEO7UZ5Pg33Qx/1XlrZPcL/iWe5gUf2Lxsl:bGFM7xBHBKzEO4Z5P23q9kL6+02Lxsl
TLSH: T1C134BFF350C7DD883A47AB036DEA1496625BD288A237DB7449C87B3CC5BC1BDAE04911
Submitted as: xarupogolovosopiro.pdf
File type: pdf · Size: 52498 bytes
Verdict: malicious (72/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 72/100 is the fusion of 6 weighted signals:

Contacted 12 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://zaman.willowynn.com/uploads/1/3/1/4/131437987/lozavajediwezerar.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://ggtraff.ru/strik?keyword=argumentative+composition+pdf, http://nazozom.crispusattucksalumnilettermen.com/uploads/1/3/2/6/132682565/9926976.pdf, http://files.wcrpla.org/uploads/1/3/1/8/131871533/ac9b792a77.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (12 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9718 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 2425f316caf7f2378a3ec707b9d2b5e630934ff4ec1f65c9972065e6333dcfa4
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\3e3325559676869c966dec4c32402284.png - 83bd967e989d77fc1b77c29b8a22646c5febc4c2bd3cbfdc151ab89d4415b04b
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://ggtraff.ru/strik?keyword=argumentative+composition+pdf
http://nazozom.crispusattucksalumnilettermen.com/uploads/1/3/2/6/132682565/9926976.pdf
http://files.wcrpla.org/uploads/1/3/1/8/131871533/ac9b792a77.pdf
http://rusox.olvsf.org/uploads/1/3/1/3/131384021/jidedulanope.pdf
http://files.287ranchsupplyboutique.com/uploads/1/3/1/1/131163832/2370986.pdf
http://files.alisaherriman.com/uploads/1/3/0/7/130738955/sijuvowa.pdf
http://files.coheartgallery.org/uploads/1/3/0/7/130739747/75bb0953d59c17.pdf
http://goboxu.woodenshoeauction.com/uploads/1/3/0/9/130969937/pujewelofod_misuse.pdf
http://zaman.willowynn.com/uploads/1/3/1/4/131437987/lozavajediwezerar.pdf
http://files.eclipseafterglowstudios.com/uploads/1/3/1/8/131871816/9eeb0c6e1d5738.pdf
http://files.frontrangetheatre.org/uploads/1/3/1/3/131384432/d0280.pdf
http://files.airsoftparts.online/uploads/1/3/0/7/130776211/sozoxi-difuranadifi-gemubajozijudis.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787775485&P2=404&P3=2&P4=n4XcGKwDEeAMzSzi9y5GPcYfQiPYIz2GgzLrSVQzlb%2fb06A5zGMGxmIcOQ0SqvHUZieVvO4%2fDOs%2bxK04ljC62g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787775553&P2=404&P3=2&P4=ER%2f%2flszC9RV9VIE0dywG41r7U8pbMTNooAKR92aIeL%2b4ldJbjboqHPQb0wuW8Jy8dlE1rixojJ4uraYy7gxurQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ggtraff.ru
nazozom.crispusattucksalumnilettermen.com
files.wcrpla.org
rusox.olvsf.org
files.287ranchsupplyboutique.com
files.alisaherriman.com
files.coheartgallery.org
goboxu.woodenshoeauction.com
zaman.willowynn.com
files.eclipseafterglowstudios.com
files.frontrangetheatre.org
files.airsoftparts.online
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

4.247.188.233
52.123.252.239
4.230.171.124
20.42.179.204
135.233.95.144
135.233.95.135
52.123.129.14
135.233.45.221
203.26.79.13
74.178.232.29
4.150.223.97
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report