MALICIOUS — normal_5fc7412b5e2a6.pdf

MALICIOUS — normal_5fc7412b5e2a6.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: f906c831dcb63abc70afe53a44a4b9d9135f6674d43a6a1e044f36dc741be988
SHA-1: b28777df531af053e1e745135cd8ad3bf81c4010
MD5: cecf26683c004d0f241f5966ebec8add
ssdeep: 1536:ModN8RfbaqycNw6syg8291t0hos63684FKcBI4Qvb3bmf0:XN8tbaqycNGygYhoJ3KFnBI4Qvb3bh
TLSH: T12A37E0F77157EDDC76869F13A2EA29287548CF0D2432DBB44094BB2CC0B9ABD2E15910
Submitted as: normal_5fc7412b5e2a6.pdf
File type: pdf · Size: 69987 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://uploads.strikinglycdn.com/files/1b961134-3be7-49e5-afea-7f31d560b047/workover_well_control_manual.pdf - network signal, weight 0.70, confidence 0.80
Contacted 14 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://trafftec.ru/123?utm_term=extra+large+toaster+oven+cover, https://mumixopid.weebly.com/uploads/1/3/1/8/131872042/2585702.pdf, https://jabizujosewej.weebly.com/uploads/1/3/4/5/134584717/dedaxetukatowe_tojusuvo_dukevamizuxad_tusujozolula.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9767 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
250.255.255.239.in-addr.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\be7853fcc0874703675a4ddeecae4e9a.png - b753326ff14c2efc186b990e60c951b8021879831cabd47e6d620bffbfc02e60
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 2d19316117176d66b30bed275b4dc71642334086e0062b756e02250564ccb130
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://trafftec.ru/123?utm_term=extra+large+toaster+oven+cover
https://mumixopid.weebly.com/uploads/1/3/1/8/131872042/2585702.pdf
https://jabizujosewej.weebly.com/uploads/1/3/4/5/134584717/dedaxetukatowe_tojusuvo_dukevamizuxad_tusujozolula.pdf
https://gosawopidelogeb.weebly.com/uploads/1/3/4/7/134714887/225d25ab.pdf
https://s3.amazonaws.com/xazarujokemus/35905237793.pdf
https://s3.amazonaws.com/sonutopexaramuf/78496785723.pdf
https://pudegubazamase.weebly.com/uploads/1/3/1/1/131163945/b7b545d2f0a5ef1.pdf
https://uploads.strikinglycdn.com/files/1b961134-3be7-49e5-afea-7f31d560b047/workover_well_control_manual.pdf
https://kagodititaf.weebly.com/uploads/1/3/4/8/134868324/buzubamimotajunoxi.pdf
https://merebidoso.weebly.com/uploads/1/3/4/3/134344951/6962090.pdf
https://uploads.strikinglycdn.com/files/732bb470-c12e-48af-a013-10be74ac9cd5/47000382023.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787756004&P2=404&P3=2&P4=ncNWhvaxSrlKrPqsuBC0griqvfBWGbQUBXLZJb%2bEtPZJKJK0ylH7BOoiJw0783zHZsFnV8xPq5%2bA3pj7mj%2ba%2fg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787756105&P2=404&P3=2&P4=AsOUctNGfVz0M1mvva0ouiPp3ZIeKKBqED6RY6qHW184Zx2x1l1GXdy0aD3TPkPXbNFqycq0v8SvR2MrEY9FFA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

trafftec.ru
mumixopid.weebly.com
jabizujosewej.weebly.com
gosawopidelogeb.weebly.com
s3.amazonaws.com
pudegubazamase.weebly.com
uploads.strikinglycdn.com
kagodititaf.weebly.com
merebidoso.weebly.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

172.172.255.218
20.42.72.131
52.110.12.51
4.230.171.124
4.149.210.175
48.211.4.16
74.178.240.61
135.233.95.135
203.26.79.13
52.123.128.14
40.99.134.2
92.223.78.30
135.234.160.244
135.232.92.34

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report