SUSPICIOUS — normal_5f8737297bef9.pdf
SUSPICIOUS — normal_5f8737297bef9.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (68/100). 2 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
f8b2b3f442cff54f6393dc657b05cc61f6055b7b0e8716c395e3ff9d11931b4d - SHA-1:
f783f97dfd7d3673bf57e37733c979c73b553273 - MD5:
99b858524c3014fcdb4dde98601cec28 - ssdeep:
768:4gGzpDzp9cRDMg6JaxE7hwWH5xgJut7uExt61Vc2/OG5CgwkJXdTe8GBlwSz6zG:VGFPp9vvMuc/B+mta8OuSz2G - TLSH:
T16C307DF310A3ED8C7A8F9F03AEAB115D644AC749A132D7A05588672CD47CABD3E40951 - Submitted as: normal_5f8737297bef9.pdf
- File type: pdf · Size: 38391 bytes
- Verdict: suspicious (68/100)
Detections (2 of 53 engines)
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The suspicious score of 68/100 is the fusion of 5 weighted signals:
- Contacted 19 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded link rated suspicious by URL analysis: https://cdn-cms.f-static.net/uploads/4365612/normal_5f873685c6a03.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://ggtraff.ru/123?keyword=handbook+of+biomaterials+properties+pdf, https://cdn.shopify.com/s/files/1/0495/9895/5684/files/siraporikotoruxizigurojiv.pdf, https://cdn.shopify.com/s/files/1/0484/0076/0981/files/rain_bird_esp-4_owners_manual.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Extracted generic config (7 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
9666 behavior events · 0 ATT&CK techniques · 3 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- 250.255.255.239.in-addr.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- ntp.ubuntu.com
- desktop-hsgcbep._dosvc._tcp.local
- desktop-hsgcbep
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
Dropped files
- C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\e619ac3f4aa4b8622e5afc8d13f03978.png -
a3b21103c58f61602327ea39aac2162e9211afbf4fbdbeda313edf0e8ba0f645 - C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt -
fbc89947212dc08b12142d19aaf7709fc673a7d5c5b54443883e7fe295301f89 - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://ggtraff.ru/123?keyword=handbook+of+biomaterials+properties+pdf
- https://cdn.shopify.com/s/files/1/0495/9895/5684/files/siraporikotoruxizigurojiv.pdf
- https://cdn.shopify.com/s/files/1/0484/0076/0981/files/rain_bird_esp-4_owners_manual.pdf
- https://cdn.shopify.com/s/files/1/0431/9235/2932/files/9234818012.pdf
- https://cdn.shopify.com/s/files/1/0432/6791/5936/files/messenger_apk_uptodown.pdf
- https://cdn.shopify.com/s/files/1/0498/7820/4574/files/kinston_high_school_address.pdf
- https://cdn.shopify.com/s/files/1/0437/7598/3778/files/gusor.pdf
- https://cdn.shopify.com/s/files/1/0482/6074/3329/files/85088226841.pdf
- https://cdn.shopify.com/s/files/1/0496/6180/4693/files/dijibexegotisupuzaretutab.pdf
- https://tudupumodowi.weebly.com/uploads/1/3/1/4/131406798/nenanofot.pdf
- https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/8536469.pdf
- https://jeponiruwapin.weebly.com/uploads/1/3/0/7/130776483/powuwenalapufaxusun.pdf
- https://jatorogerujew.weebly.com/uploads/1/3/2/7/132710569/bawap.pdf
- https://bedizegoresupa.weebly.com/uploads/1/3/1/3/131379398/3794757.pdf
- https://cdn-cms.f-static.net/uploads/4366035/normal_5f8731fb09167.pdf
- https://cdn-cms.f-static.net/uploads/4365547/normal_5f87130328aef.pdf
- https://cdn-cms.f-static.net/uploads/4365619/normal_5f872fbf65c9f.pdf
- https://cdn-cms.f-static.net/uploads/4366316/normal_5f87365e29c10.pdf
- https://cdn-cms.f-static.net/uploads/4365612/normal_5f873685c6a03.pdf
- https://uploads.strikinglycdn.com/files/3b556bed-69a6-4edb-8cb0-bba71bf00b88/wogogimotivekemumozaninu.pdf
- https://uploads.strikinglycdn.com/files/d56c9803-5bdb-4c11-9204-1851c6dd0def/burevejokiwixetiro.pdf
- https://uploads.strikinglycdn.com/files/f4cbd06d-2f37-4a0e-8217-70320562fb89/futimimujubololoko.pdf
- https://cdn-cms.f-static.net/uploads/4366381/normal_5f8736fd74ef0.pdf
- https://cdn-cms.f-static.net/uploads/4366397/normal_5f87289196eb2.pdf
- https://cdn-cms.f-static.net/uploads/4365600/normal_5f86fdb8bbf3b.pdf
Embedded domains
- ggtraff.ru
- cdn.shopify.com
- tudupumodowi.weebly.com
- jakedekokobara.weebly.com
- jeponiruwapin.weebly.com
- jatorogerujew.weebly.com
- bedizegoresupa.weebly.com
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Embedded IP addresses
- 135.232.92.137
- 52.123.252.213
- 4.230.171.124
- 4.144.132.223
- 4.247.188.233
- 20.165.94.63
- 135.233.95.135
- 20.112.250.133
- 40.99.134.18
- 52.123.129.14
- 92.223.78.30
- 135.234.160.245
- 74.179.71.159
- 203.26.79.13
- 52.123.252.194
- 135.234.160.244
- 4.209.250.170
- 13.89.179.15
- 52.148.114.188
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report