MALICIOUS — 03eccc9baf07a23ea27c7674200a06ca3d3bcf2290a7fbfe1a2eaafaad329663

MALICIOUS — 03eccc9baf07a23ea27c7674200a06ca3d3bcf2290a7fbfe1a2eaafaad329663 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 03eccc9baf07a23ea27c7674200a06ca3d3bcf2290a7fbfe1a2eaafaad329663
SHA-1: 3f0b259cdf919072742059533f2cbba622119ac9
MD5: d2dd2882c9b57c32a85d0d8b64efbbc0
ssdeep: 1536:jmf+JQZXVEdc7jVq+N2oXN/Qa5msZEZOgIKGCaNMcpAVCFKPvJjQm/4fzDvPC3p:yfcQ7ZVqE2oXZQaIsZEZjIpCaNMcpAVB
TLSH: T12539D0F35297FE9CBB4BCB076CBA219DB489D3D512329B9009847B6CC4A45BE1E02940
Submitted as: 03eccc9baf07a23ea27c7674200a06ca3d3bcf2290a7fbfe1a2eaafaad329663
File type: pdf · Size: 84938 bytes
Verdict: malicious (98/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!D2DD2882C9B5
Kaspersky (KVRT): HEUR:Hoax.PDF.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://uploads.strikinglycdn.com/files/a005db5d-f620-4507-b346-4deddcdffa11/calories_in_fruits_and_vegetables_chart_printable.pdf - network signal, weight 0.70, confidence 0.80
Contacted 22 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://catamma.ru/pbw?utm_term=bairavaa+tamil+full+movie+hd, http://xoxafepapesu.pbworks.com/w/file/fetch/144794847/zosarowox.pdf, http://rorazokazog.pbworks.com/w/file/fetch/144731220/quadrilaterals_worksheet_grade_4.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9758 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
250.255.255.239.in-addr.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
_dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\48f17a3b66ca760749625e282a27d118.png - 4a278a48213f944308cc175d2ce19814580523a6d1f958a63bee2a9b1619c015
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - b2064115b3b7302d40b0d929d1fa357a8ab0166b7ea8cb242a14993d00c31fa5
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://catamma.ru/pbw?utm_term=bairavaa+tamil+full+movie+hd
http://xoxafepapesu.pbworks.com/w/file/fetch/144794847/zosarowox.pdf
http://rorazokazog.pbworks.com/w/file/fetch/144731220/quadrilaterals_worksheet_grade_4.pdf
https://cdn-cms.f-static.net/uploads/4405443/normal_5fd98e558f4f3.pdf
https://mapevitesofik.weebly.com/uploads/1/3/1/6/131606073/f29b539df22c.pdf
https://kalujobad.weebly.com/uploads/1/3/4/3/134390175/loramuliza.pdf
https://uploads.strikinglycdn.com/files/a005db5d-f620-4507-b346-4deddcdffa11/calories_in_fruits_and_vegetables_chart_printable.pdf
https://tolafapod.weebly.com/uploads/1/3/4/4/134486806/juguxexer_geraxug_besivujexop.pdf
http://xefobukeza.pbworks.com/f/20679258195.pdf
http://wiwedano.pbworks.com/w/file/fetch/144591237/how_to_get_someones_ip_on_xbox_live.pdf
http://wixumip.pbworks.com/f/bahubali_2_full_movie_tamil_hd_download_tamilrockers.pdf
https://uploads.strikinglycdn.com/files/7d61e541-44cc-43cd-ae3f-2f3d3a560e49/75099240259.pdf
https://gotumofavi.weebly.com/uploads/1/3/4/6/134602885/106168d1d135f54.pdf
http://gulisapil.pbworks.com/w/file/fetch/144420846/silabepeziramut.pdf
https://static.s123-cdn-static.com/uploads/4458124/normal_6000d8f11d07f.pdf
http://rasovuxosew.pbworks.com/w/file/fetch/144912318/forklift_driver_test_questions_answers.pdf
https://telexetobowu.weebly.com/uploads/1/3/4/3/134339901/8450394.pdf
https://static.s123-cdn-static.com/uploads/4461495/normal_5fccbc7940e5b.pdf
http://pozapagula.pbworks.com/w/file/fetch/144609531/bhagwat_gita_hindi_book.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

catamma.ru
xoxafepapesu.pbworks.com
rorazokazog.pbworks.com
cdn-cms.f-static.net
mapevitesofik.weebly.com
kalujobad.weebly.com
uploads.strikinglycdn.com
tolafapod.weebly.com
xefobukeza.pbworks.com
wiwedano.pbworks.com
wixumip.pbworks.com
gotumofavi.weebly.com
gulisapil.pbworks.com
static.s123-cdn-static.com
rasovuxosew.pbworks.com
telexetobowu.weebly.com
pozapagula.pbworks.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

104.208.16.94
172.172.255.217
74.179.71.159
57.155.104.224
52.123.129.14
74.178.76.128
52.110.12.45
85.210.193.152
4.230.171.124
4.150.223.96
74.178.76.54
20.76.201.171
20.184.175.5
74.178.76.44
203.26.79.13
74.178.240.61
52.123.252.223
52.123.252.232
52.123.252.224
172.178.240.162
48.192.143.121
4.150.223.109

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report