MALICIOUS — 000c28f8f1a03d5f3862ff525a5a5de8bcdb97256b3b1f9d88cacc0cf377b29d

MALICIOUS — 000c28f8f1a03d5f3862ff525a5a5de8bcdb97256b3b1f9d88cacc0cf377b29d is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 000c28f8f1a03d5f3862ff525a5a5de8bcdb97256b3b1f9d88cacc0cf377b29d
SHA-1: 52a24b35d0c4b116f292a0d9fc1d2f47d1a3177d
MD5: 908f4de7f59c74efb767ecbaf3fb5036
ssdeep: 1536:ttbiIRt5UUt92dsEcH7Fla7u7bHdNW6pOu23tJW0KA6tjktOJ1iD:DiuUU26E47Fiu7b9eu29j6trJ8
TLSH: T15639D0F32097ED8C778A9F0369FB25296499DB882171FBA040C9392CD5BC6BD2F04911
Submitted as: 000c28f8f1a03d5f3862ff525a5a5de8bcdb97256b3b1f9d88cacc0cf377b29d
File type: pdf · Size: 86784 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://come2menorca.com/images/file/ladezedetikuguvilol.pdf - network signal, weight 0.70, confidence 0.80
Contacted 22 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://senesi-sklad.cz/userfiles/file/54184732477.pdf, http://come2menorca.com/images/file/ladezedetikuguvilol.pdf, https://dabanbep.tanglehadong.com/upload/files/62694019786.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9654 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
desktop-hsgcbep
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 6d16aedcce1766d30b98935b8d3bbcf62705aecf5725800a650c92d3995c2a64
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\d7fcb560ff0cfc2562e913306c296d74.png - 9bb2d1f12874b2e7465143b9a839048bad73866986540cff3d5784ffbf335995
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/ngfLrbzwjls/uplcv?utm_term=pes+club+manager+download
https://senesi-sklad.cz/userfiles/file/54184732477.pdf
http://come2menorca.com/images/file/ladezedetikuguvilol.pdf
https://dabanbep.tanglehadong.com/upload/files/62694019786.pdf
http://hoteldanang.com/uploads/images/files/nipibekawofunuvelalaloga.pdf
https://pierrelemagicien.com/userfiles/file/83139101166.pdf
http://studiotecnicodavico.eu/userfiles/files/41445571648.pdf
https://growyourmoney.in/userfiles/files/narujesanoxaraz.pdf
http://enjoyisagenix.com/ckfinder/userfiles/files/18486284148.pdf
http://tencanpowder.com/d/files/naxazoxogukafifozaro.pdf
https://senzedigicraft.com/wp-content/plugins/super-forms/uploads/php/files/c60b2d9c43c697c9ed7078b5eb2d69ce/57040016722.pdf
http://gesundezellen.de/neu/userfiles/file/segurinerujufewojuwafefi.pdf
http://www.taylormadetc.com/siteadmin/ckfinder/userfiles/files/zevasokaxi.pdf
https://ontogepszerviz.hu/editor_up/kogijosafanepebow.pdf
http://h-st.nl/bestanden/files/71577637605.pdf
http://bctlorraine.org/userfiles/file/35336138845.pdf
http://acelybio.com/upload/files/zibutuf.pdf
http://oldadmin.k12cart.com/media/files/xogixilerewetujagabamasof.pdf
https://dpt-mh.com/uploads/news/files/56612470675.pdf
http://cdkkck.com/uploadfile/file/20210905042507.pdf
http://news-hk.net/uploadfile/file///52456542381.pdf
http://kronikarp.pl/ckfinder/userfiles/files/10040817932.pdf
https://www.frontierexim.com/wp-content/plugins/super-forms/uploads/php/files/709irkpv2qh9m0u64spfc0jpf6/ranelutuzag.pdf
http://rowadhr.com/app/webroot/upload/files/87380991903.pdf
http://villalapinetafavignana.it/userfiles/files/74483300638.pdf

Embedded domains

feedproxy.google.com
come2menorca.com
dabanbep.tanglehadong.com
hoteldanang.com
pierrelemagicien.com
studiotecnicodavico.eu
growyourmoney.in
enjoyisagenix.com
tencanpowder.com
senzedigicraft.com
gesundezellen.de
www.taylormadetc.com
h-st.nl
bctlorraine.org
acelybio.com
oldadmin.k12cart.com
dpt-mh.com
cdkkck.com
news-hk.net
kronikarp.pl
www.frontierexim.com
rowadhr.com
villalapinetafavignana.it
www.w3.org
purl.org

Embedded IP addresses

40.84.85.40
85.210.196.11
20.42.73.31
52.123.252.235
52.110.12.47
4.247.188.233
4.230.171.124
20.247.184.142
74.179.77.164
135.233.95.144
74.179.77.204
104.46.162.229
52.123.129.14
135.232.92.34
72.145.35.104
203.26.79.13
20.42.179.192
92.223.78.30
20.42.73.26
172.170.180.133
4.150.223.103
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report