MALICIOUS — 03aa4a716b9027879094c439a148a262f2b56e1c3f3ff8f7ea66769b9ef50876

MALICIOUS — 03aa4a716b9027879094c439a148a262f2b56e1c3f3ff8f7ea66769b9ef50876 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 03aa4a716b9027879094c439a148a262f2b56e1c3f3ff8f7ea66769b9ef50876
SHA-1: 783485911011ea0aa762840b9d26e7f26f01a2bd
MD5: 672b26e5d0e966ae65e1c022e385e3b0
ssdeep: 1536:qeLNm4fMF3DMvSB4aupnRwJSMd1DklOoHriWLc9aJbXfnE7Gv1WXpO/k8a:rSzIk4aupRvMMx4aJnEav//i
TLSH: T11D38DFF352D7EE1C72878F573EE61244A58AD78851B6EB905088B73C913CABD7E11820
Submitted as: 03aa4a716b9027879094c439a148a262f2b56e1c3f3ff8f7ea66769b9ef50876
File type: pdf · Size: 83850 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://salman-is.com/userfiles/file/bipola.pdf - network signal, weight 0.70, confidence 0.80
Contacted 20 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://oniceh.ru/uplcv?utm_term=necrosis+on+foot, http://nfc.soo.jp/file/femedasedujufixi.pdf, http://w.scenekunstskolen-efteruddannelsen.dk/ckfinder/userfiles/files/funopodugonigurixop.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9677 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
_dosvc._tcp.local
ntp.ubuntu.com
desktop-hsgcbep
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 306183605d499e2faba1e08a0ccb7e7fa4d796a5503488ca3445cb1c385b10e7
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\d42d898d184eb5bbc04956a09754f414.png - bb534bf771faeac0e043ea5038c5c2c8eca6ea29224ea67025fbcbb647796288
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://oniceh.ru/uplcv?utm_term=necrosis+on+foot
http://nfc.soo.jp/file/femedasedujufixi.pdf
http://w.scenekunstskolen-efteruddannelsen.dk/ckfinder/userfiles/files/funopodugonigurixop.pdf
https://intersat.lv/files/file/namasepitufude.pdf
http://mirsistem.com/depo/sayfaresim/file/jerujiridat.pdf
http://wwm-quanta.com/upload/files/30710773036.pdf
http://walosports.cl/userfiles/file/68978980704.pdf
https://christembassyromford.org/wp-content/plugins/super-forms/uploads/php/files/c6e820582d59b615293a81b86a42b930/18521333264.pdf
https://efckrakow.pl/userfiles/file/8589764851.pdf
http://salman-is.com/userfiles/file/bipola.pdf
http://scamps.biz/userfiles/file/88513027065.pdf
http://villaelen.it/userfiles/files/16010032651.pdf
http://batiment-tunisie.com/userfiles/file/77596302976.pdf
http://montpellier-business-plan.eu/mbp/upload/images/images/upload/ckfinder/34701941850.pdf
http://novo-foto.ru/ckfinder/userfiles/files/13593642765.pdf
http://paraglider24.de/pics/fotos/1/file/11728965606.pdf
http://ags-sib.ru/ckfinder/userfiles/files/53438625151.pdf
https://www.audifonosdoshoydos.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614d176420f99---lokomibelikofojov.pdf
http://randoquad72.fr/userfiles/file/39407611881.pdf
http://architetturaurbanistica.it/userfiles/files/64402257634.pdf
http://elitakhealing.com/ckfinder/userfiles/files/zozise.pdf
https://macintosh-szerviz-javitas.nuttydog.hu/ckfinder/userfiles/files/lobavi.pdf
http://problemconsulting.com/img/download/files/51907928804.pdf
http://hosungtour.net/FileData/ckfinder/files/20211011_8330EDEFF2D82DE8.pdf
http://tfforming.ru/d/files/gisubogiwoxevupalape.pdf

Embedded domains

oniceh.ru
nfc.soo.jp
mirsistem.com
wwm-quanta.com
christembassyromford.org
efckrakow.pl
salman-is.com
scamps.biz
villaelen.it
batiment-tunisie.com
montpellier-business-plan.eu
novo-foto.ru
paraglider24.de
ags-sib.ru
www.audifonosdoshoydos.com
randoquad72.fr
architetturaurbanistica.it
elitakhealing.com
problemconsulting.com
hosungtour.net
tfforming.ru
kindervakantieweekdeurne.nl
poetische-malerei.de
www.w3.org
purl.org

Embedded IP addresses

4.247.188.233
135.232.92.34
172.172.255.218
72.145.35.106
20.42.65.89
20.165.94.46
20.247.184.142
52.110.12.47
4.230.171.124
40.84.97.4
203.26.79.13
4.150.223.114
74.178.76.128
20.76.201.171
52.123.252.218
52.123.128.14
172.178.240.163
172.170.180.133
4.150.223.111
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report