MALICIOUS — 7f614e_e042e76ac4a94ab1896f4ca0c74bd62d.pdf
MALICIOUS — 7f614e_e042e76ac4a94ab1896f4ca0c74bd62d.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (85/100). 2 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
f6e970cb06804918e9a4ee054488b48688df71cbf4b64d804336655e92a7999d - SHA-1:
bdc714cffb4d69de581fac397e22888bea4bc746 - MD5:
4f09b5ad76f3b3dcd44f45411086a3dd - ssdeep:
768:igGzpDU/YI/P6UtB9nOdYOCDB6mEWzB312PtweixjTcsghd:/GFoVnOwl/T3QVipTcnhd - TLSH:
T1CA31AFF30197DD8D3E8BAF07A9E6115D7186C3897133AAA04888772DC47C7ED6E10A61 - Submitted as: 7f614e_e042e76ac4a94ab1896f4ca0c74bd62d.pdf
- File type: pdf · Size: 42576 bytes
- Verdict: malicious (85/100)
Detections (2 of 54 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The malicious score of 85/100 is the fusion of 7 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - Contacted 12 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ttraff.link/wix?keyword=suite+francaise+book+pdf+download, https://afca06a4-1b84-45b6-9d93-9c32cbda57ff.filesusr.com/ugd/a32c20_b036b19b13f8456798fa20d74cd443c7.pdf?index=true, https://52c9114b-642d-4e0c-a3f4-b619af2a14ca.filesusr.com/ugd/78daac_bb90c960789f410f82860b1edb5797f4.pdf?index=true - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Extracted generic config (10 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
1029 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ntp.ubuntu.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://c.pki.goog/r/r1.crl
- http://x2.c.lencr.org/
- http://ye.c.lencr.org/
- http://yr.c.lencr.org/
- 23.40.52.209
Dropped files
- root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://ttraff.link/wix?keyword=suite+francaise+book+pdf+download
- https://afca06a4-1b84-45b6-9d93-9c32cbda57ff.filesusr.com/ugd/a32c20_b036b19b13f8456798fa20d74cd443c7.pdf?index=true
- https://52c9114b-642d-4e0c-a3f4-b619af2a14ca.filesusr.com/ugd/78daac_bb90c960789f410f82860b1edb5797f4.pdf?index=true
- https://f4b02bdb-f372-4347-a575-08fb46aaa821.filesusr.com/ugd/565485_37f5ebf157594639b27f85b374608a4a.pdf?index=true
- https://00819d8f-8d29-41fa-81e6-d452beb49495.filesusr.com/ugd/b463f2_1953755e6bce45b8a9a4ed1780a3ab78.pdf?index=true
- https://cdn.shopify.com/s/files/1/0437/4170/8453/files/arrian_anabasis_of_alexander.pdf
- https://cdn.shopify.com/s/files/1/0432/7201/1931/files/77222327019.pdf
- https://cdn.shopify.com/s/files/1/0431/2930/7293/files/91363169422.pdf
- https://3008dbc3-38d8-4443-ba1b-c5fa4a5050c3.filesusr.com/ugd/29c71c_e435a6aea7d14e829fa39a3133d0c592.pdf?index=true
- https://b6ac6761-cf44-4437-bde7-7b391fa05e0f.filesusr.com/ugd/e643da_d0c49f29ac32469b8109789fd7a54a55.pdf?index=true
- https://e13a8b0f-cdbb-4ea6-8e26-413b335614fc.filesusr.com/ugd/5ea691_963c9421f94540feb0d1c2b7950de757.pdf?index=true
- https://d15d547a-2908-4e3a-8705-aaea812289d6.filesusr.com/ugd/49f5ef_efb8c2b90bad4f46a06755a56031d2bc.pdf?index=true
- https://1d5e2b0b-826c-4eb2-a1ae-aa5470267331.filesusr.com/ugd/2eff39_401177437ef348028fe07fb5cdd4b27a.pdf?index=true
- https://cdn.shopify.com/s/files/1/0427/4877/2508/files/vanguard_brokerage_account_agreement.pdf
- https://cdn.shopify.com/s/files/1/0431/4637/9426/files/imperialismo_linguistico.pdf
- https://cdn.shopify.com/s/files/1/0438/3532/6624/files/real_estate_lease_addendum_form.pdf
- https://cdn.shopify.com/s/files/1/0427/9717/0847/files/81115563797.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
Embedded domains
- ttraff.link
- afca06a4-1b84-45b6-9d93-9c32cbda57ff.filesusr.com
- 52c9114b-642d-4e0c-a3f4-b619af2a14ca.filesusr.com
- f4b02bdb-f372-4347-a575-08fb46aaa821.filesusr.com
- 00819d8f-8d29-41fa-81e6-d452beb49495.filesusr.com
- cdn.shopify.com
- 3008dbc3-38d8-4443-ba1b-c5fa4a5050c3.filesusr.com
- b6ac6761-cf44-4437-bde7-7b391fa05e0f.filesusr.com
- e13a8b0f-cdbb-4ea6-8e26-413b335614fc.filesusr.com
- d15d547a-2908-4e3a-8705-aaea812289d6.filesusr.com
- 1d5e2b0b-826c-4eb2-a1ae-aa5470267331.filesusr.com
- www.w3.org
- purl.org
- ns.adobe.com
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 20.50.201.204
- 4.144.132.223
- 20.50.73.14
- 104.18.33.89
- 20.42.179.192
- 52.168.117.169
- 4.150.223.101
- 135.232.92.137
- 20.42.73.28
- 162.159.36.2
- 203.26.79.13
- 4.230.171.124
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report