MALICIOUS — jujebozazisa-lilog.pdf

MALICIOUS — jujebozazisa-lilog.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100). 2 of 50 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: fa9630221f1dbd7e11a5ff9769a725c008c06c5046515bf1f29061d8ba83aa6c
SHA-1: 82c541a2d1d99eb4abf39bb023f5cb295734e79a
MD5: e185e69da9f39e2ed48632ef921c8be3
ssdeep: 768:tgGzpDAq+b1WuZI6AkH3+CMfk5HgOMV6CwCb2xw5zMTk:OGFUFIfs+dfagcCwCqxw5zMTk
TLSH: T1B8319DF36097EE8C3E87AB036EAA142D1559C60C6136DAA050D8377DD4BC6AD7E10861
Submitted as: jujebozazisa-lilog.pdf
File type: pdf · Size: 39884 bytes
Verdict: malicious (93/100)

Detections (2 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1

MITRE ATT&CK

Why this verdict

The malicious score of 93/100 is the fusion of 8 weighted signals:

Dropped a malicious payload (Lazarus): root_.cache_dconf_user - dynamic signal, weight 0.80, confidence 0.90
Contacted 24 external host(s) at runtime (5 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/574547f6-3e30-4892-bee0-7ba378bf21e2/zazanobelukakowasiv.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://ggtraff.ru/wb?keyword=anticorpi%20monoclonali%20e%20tumori%20pdf, https://uploads.strikinglycdn.com/files/574547f6-3e30-4892-bee0-7ba378bf21e2/zazanobelukakowasiv.pdf, https://cdn-cms.f-static.net/uploads/4374963/normal_5f9d904700a26.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9700 behavior events · 1 ATT&CK techniques · 4 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
searchapp.bundleassets.example
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
desktop-hsgcbep
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e?P1=1786929936&P2=404&P3=2&P4=QFXIssGz0Y%2fSoj%2bXqV6l77iYnPsJYdAhOdSs4alwosh5z2MPzmBV6I71EyRY121NcyklkKD75VBpuf6j83hiAQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
23.40.52.85
23.11.37.157
162.159.142.9 US · San Francisco · AS13335 Cloudflare, Inc.

Dropped files

/opt/CAPEv2/storage/analyses/25405/files/ac660f0ad5c16d8c48e649a82342f462ce7ea010a4c2c0f66bd6e540005d5054 - ac660f0ad5c16d8c48e649a82342f462ce7ea010a4c2c0f66bd6e540005d5054
/opt/CAPEv2/storage/analyses/25405/files/7b3fd7326ddd3d22342de89162792adc68f6aeba60126cb1476ceab04d206db5 - 7b3fd7326ddd3d22342de89162792adc68f6aeba60126cb1476ceab04d206db5
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
tmp_tmp.5IksvDNYwS - 0fd5d1ff42e477b3164abeaaa48179da491fbc4e2c92ecddafcdd6e49f7f5c35

Embedded URLs

https://ggtraff.ru/wb?keyword=anticorpi%20monoclonali%20e%20tumori%20pdf
https://uploads.strikinglycdn.com/files/574547f6-3e30-4892-bee0-7ba378bf21e2/zazanobelukakowasiv.pdf
https://cdn-cms.f-static.net/uploads/4374963/normal_5f9d904700a26.pdf
https://cdn.shopify.com/s/files/1/0498/8770/7290/files/juvugofiwotixubexogo.pdf
https://uploads.strikinglycdn.com/files/b01dc57c-19d9-483c-9eb9-761561d0b7c2/99026432179.pdf
https://uploads.strikinglycdn.com/files/611b5314-f8d5-46f1-a7bb-2a5e74119442/sanegatukogudonavu.pdf
https://uploads.strikinglycdn.com/files/89afe388-3d14-4308-895e-91af3663d4bd/mikizobanu.pdf
https://uploads.strikinglycdn.com/files/384ec21b-0c17-4933-a366-8b2f30637020/nulikinavet.pdf
https://kizozejibudi.weebly.com/uploads/1/3/4/4/134460324/5437265.pdf
https://s3.amazonaws.com/tibanepoxilibud/zudikodigureka.pdf
https://cdn-cms.f-static.net/uploads/4368265/normal_5f881a6b700fb.pdf
https://uploads.strikinglycdn.com/files/1c2d054a-6b3d-445a-8df9-1b993d68860c/17499975324.pdf
https://dowikonusinewe.weebly.com/uploads/1/3/4/3/134374018/soxowepexuxedu.pdf
https://s3.amazonaws.com/sugosubexez/14053262079.pdf
https://uploads.strikinglycdn.com/files/5810a8d5-45be-4f51-b193-8c1a0b605f27/vegogiti.pdf
https://cdn-cms.f-static.net/uploads/4390637/normal_5f909abf3f463.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

ggtraff.ru
uploads.strikinglycdn.com
cdn-cms.f-static.net
cdn.shopify.com
kizozejibudi.weebly.com
s3.amazonaws.com
dowikonusinewe.weebly.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

74.178.76.128
162.159.142.9
52.123.252.243
4.247.188.224
52.110.12.3
4.230.171.124
172.178.240.163
74.179.71.159
72.145.35.103
20.112.250.133
203.26.79.13
13.69.116.105
20.165.94.63
4.207.44.66
162.159.36.2

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report