MALICIOUS — 3f8d85_965d8637e1574945800d84d7922f256c.pdf
MALICIOUS — 3f8d85_965d8637e1574945800d84d7922f256c.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100). 3 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
c41736003d7bd88dbca6115bf3372f77c189e36df2e4d3e919e143322d72caa3 - SHA-1:
ee266cead913f8bd7253ae824131ae43ac3408ba - MD5:
e4e703351c1758c082ae11adb7ed0a73 - ssdeep:
768:1mgGzpDy3GWZ8JiVv3jniQGio4bn8JayJBiTYM6zuvN5ocRIOAM6MQ:VGFe3FnnbGiown8JTJYUM9o0kM6MQ - TLSH:
T1EC318DF3509BED8C368FAF43AEAB105D648AD68D6037A2640888776CD47C6ED6F10531 - Submitted as: 3f8d85_965d8637e1574945800d84d7922f256c.pdf
- File type: pdf · Size: 40081 bytes
- Verdict: malicious (89/100)
Detections (3 of 54 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
MITRE ATT&CK
Why this verdict
The malicious score of 89/100 is the fusion of 8 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule
UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ttraff.ru/wix?keyword=social+statistics+for+a+diverse+society+7th+edition+pdf, https://4cee0d70-8c52-498b-b2e8-46e242f4e000.filesusr.com/ugd/38062a_015051bc07db44bb898b5552c8b356ad.pdf?index=true, https://a5d07f06-8b84-4af1-bc70-3538d08590d9.filesusr.com/ugd/5f226b_4bfe915c2dff4df29b181cc9f642bb79.pdf?index=true - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Contacted 6 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
1009 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- searchapp.bundleassets.example
- teams.cloud.microsoft
- inference.location.live.net
- c.pki.goog
- ntp.ubuntu.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- 23.40.52.121
- 23.11.37.157
- 20.190.167.66
- 20.190.167.64
- 74.179.77.204 US · Moses Lake · AS8075 Microsoft Corporation
- 150.171.28.11
- 20.190.167.149
- 52.230.60.54 SG · Singapore · AS8075 Microsoft Corporation
- 23.33.238.188
- 135.232.92.34 US · Boydton · AS8075 Microsoft Limited
Dropped files
- root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://ttraff.ru/wix?keyword=social+statistics+for+a+diverse+society+7th+edition+pdf
- https://4cee0d70-8c52-498b-b2e8-46e242f4e000.filesusr.com/ugd/38062a_015051bc07db44bb898b5552c8b356ad.pdf?index=true
- https://a5d07f06-8b84-4af1-bc70-3538d08590d9.filesusr.com/ugd/5f226b_4bfe915c2dff4df29b181cc9f642bb79.pdf?index=true
- https://5e0d2410-5ebf-4d81-b4fd-e56b80c1293b.filesusr.com/ugd/8bf3fc_6f9ece3f8702420abb77b044a3c2a658.pdf?index=true
- https://81c5107f-3f24-40ec-9472-3ad997b5dec4.filesusr.com/ugd/bc79a4_4c2f3d9575994b2f9ded6b3df0409f0c.pdf?index=true
- https://26b23d9e-b3d5-4fc1-b4fb-6a93ecd6dfca.filesusr.com/ugd/45fd81_521b5e1e6b224c52b22fe389e2afec57.pdf?index=true
- https://2a517046-1808-413d-8297-1dd08b4e50d9.filesusr.com/ugd/7d1dc9_492420579ab740b4b65719a695ccc41d.pdf?index=true
- https://ae13a2aa-b190-4a63-a880-eaad0ff9a51e.filesusr.com/ugd/18122d_5b59dbea6b1a449ea152de4676e5722f.pdf?index=true
- https://4a9c72df-6009-4fa5-8c0b-97e0b47aee62.filesusr.com/ugd/3e7897_f2ccdc77c3e8485791f97f4a74378358.pdf?index=true
- https://6716d76a-fd01-4d99-a7a8-11215a01848a.filesusr.com/ugd/70c1ec_8dd597ca574d410c9ac5d79d41013869.pdf?index=true
- https://ae036bd3-c385-4b37-a2e3-d2e6ad8e79b8.filesusr.com/ugd/3bf302_3a8483fc654c41d3842e3ade37b4d935.pdf?index=true
- https://faaae760-d238-46d1-bf01-67f78201d10a.filesusr.com/ugd/49f5ef_8ce7f4333682408684169d342f00d8e3.pdf?index=true
- https://ec2d82b3-50d1-45a0-a505-455e8475a453.filesusr.com/ugd/de3d83_5d37c353abfd44f885910a607baddcd1.pdf?index=true
- https://6cbef094-4100-48c0-aacf-1168e916a33a.filesusr.com/ugd/aec2ea_4e6834dc7f954d5ea1908349605d43ca.pdf?index=true
- https://3ce2854f-d621-40ce-a6a1-da8c57101bec.filesusr.com/ugd/237bf7_49edb77453cb4577908431e12a32af78.pdf?index=true
- https://2ed40b1a-52a2-42ec-9cc6-8625c883c796.filesusr.com/ugd/d7d6cd_bd4821a6374c4004bdde777b82451ce3.pdf?index=true
- https://cdn.shopify.com/s/files/1/0438/8651/0232/files/43745584668.pdf
- https://cdn.shopify.com/s/files/1/0428/9334/4924/files/woxedetuduvib.pdf
- https://cdn.shopify.com/s/files/1/0433/7192/1571/files/xowipuxi.pdf
- https://cdn.shopify.com/s/files/1/0428/3901/5580/files/68106519412.pdf
- https://cdn.shopify.com/s/files/1/0434/0423/0805/files/septic_arthritis_treatment_guidelines_idsa.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- ttraff.ru
- 4cee0d70-8c52-498b-b2e8-46e242f4e000.filesusr.com
- a5d07f06-8b84-4af1-bc70-3538d08590d9.filesusr.com
- 5e0d2410-5ebf-4d81-b4fd-e56b80c1293b.filesusr.com
- 81c5107f-3f24-40ec-9472-3ad997b5dec4.filesusr.com
- 26b23d9e-b3d5-4fc1-b4fb-6a93ecd6dfca.filesusr.com
- 2a517046-1808-413d-8297-1dd08b4e50d9.filesusr.com
- ae13a2aa-b190-4a63-a880-eaad0ff9a51e.filesusr.com
- 4a9c72df-6009-4fa5-8c0b-97e0b47aee62.filesusr.com
- 6716d76a-fd01-4d99-a7a8-11215a01848a.filesusr.com
- ae036bd3-c385-4b37-a2e3-d2e6ad8e79b8.filesusr.com
- faaae760-d238-46d1-bf01-67f78201d10a.filesusr.com
- ec2d82b3-50d1-45a0-a505-455e8475a453.filesusr.com
- 6cbef094-4100-48c0-aacf-1168e916a33a.filesusr.com
- 3ce2854f-d621-40ce-a6a1-da8c57101bec.filesusr.com
- 2ed40b1a-52a2-42ec-9cc6-8625c883c796.filesusr.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Embedded IP addresses
- 74.179.77.204
- 52.230.60.54
- 135.232.92.34
- 72.154.7.103
- 162.159.36.2
- 4.230.171.124
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report