MALICIOUS — 056a24ac07beb6750a878eb13164b0954ccb9b154dc19d74471b1a121c95a519

MALICIOUS — 056a24ac07beb6750a878eb13164b0954ccb9b154dc19d74471b1a121c95a519 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 056a24ac07beb6750a878eb13164b0954ccb9b154dc19d74471b1a121c95a519
SHA-1: d8452e9ce248bcf0addab28688c7e32dbc93748c
MD5: 76823ab1e2320714223557663b46bf21
ssdeep: 1536:Am3onpTDaUkDpcdy9VyQCLOT7DzG0fWL6ooU47ZWbpON9K7JegOU7d:LYKDp0lQCUPiW7bNAFvO+
TLSH: T17438C0F321A3CC5C7A86DB037DF7059CA48AD7C81672AE508488766CD97C6BD6E04A50
Submitted as: 056a24ac07beb6750a878eb13164b0954ccb9b154dc19d74471b1a121c95a519
File type: pdf · Size: 79890 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://rebeccaosborne.com/uploads/jenuvinejunagakimivopu.pdf - network signal, weight 0.70, confidence 0.80
Contacted 20 external host(s) and 8 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://krisoc.ru/uplcv?utm_term=prokaryotic+vs+eukaryotic+cells+venn+diagram, http://ityab.com/cache/fck_files/file/wimikewezuj.pdf, https://sharkovinkom.com/sharkovinkom.com/ckfinder/userfiles/files/66487545609.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9725 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
_dosvc._tcp.local
desktop-hsgcbep._dosvc._tcp.local
desktop-hsgcbep(1)._dosvc._tcp.local
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787947285&P2=404&P3=2&P4=N3M9gzDG5drunrhUkYHeAPFwXRNoxYVev08g3GUlOIlnoYQ7A6ZxhMvz4YvnJmVjETj%2bqRrwuSiMYZ0mZNfvzg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\1cd933c787bbf32e33a87af5ebc4a23d.png - 4b956ab2773aa1d23c2c33b5effa7c9e187be6794e59b6786940229e2b3268f4
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 5a7b8a9ade90783c9b9ee4de3cf4b937d76160fd11779b1c9011a477dbd62818
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://krisoc.ru/uplcv?utm_term=prokaryotic+vs+eukaryotic+cells+venn+diagram
http://ityab.com/cache/fck_files/file/wimikewezuj.pdf
https://sharkovinkom.com/sharkovinkom.com/ckfinder/userfiles/files/66487545609.pdf
https://shoppe.everybodyisnotdoingit.org/gift/userfiles/files/vefogidopix.pdf
http://bpabv.nl/uploadfiles/file/52430591601.pdf
https://edinburghpools.com/contents/files/816832508.pdf
http://altadirezione-consulting.it/userfiles/files/pajuvozadumawibafutid.pdf
http://stonebreaker.at/49661022840.pdf
https://www.ijdsir.com/ckfinder/userfiles/files/32110067877.pdf
http://rebeccaosborne.com/uploads/jenuvinejunagakimivopu.pdf
http://ourpreferred.com/userfiles/files/19335053857.pdf
http://ashioke.com/images/library/File/74216868997.pdf
http://artospace.com/pics/file/65785304042.pdf
http://ieltsadd.ir/cache/fck_files/file/55159213705.pdf
https://a1-recruitment.fr/v2011/Files/fck_upload/file/839501173.pdf
http://yourhealthyanswer.com/ckfinder/userfiles/files/gotajovavami.pdf
http://mayingiabao.com/upload/files/soterumutelalaj.pdf
http://studioambienteterritorio.it/userfiles/files/24372458522.pdf
https://aguiapromocional.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1613d60e426343---13888826570.pdf
https://hiperaktivite.info/userfiles/files/vafimefikowix.pdf
http://alburigiott.it/userfiles/files/zepisikuxe.pdf
http://hiro-seiko.com/upload/files/20620621450.pdf
https://claudiodituri.it/uploads/gosafoj.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/

Embedded domains

krisoc.ru
ityab.com
sharkovinkom.com
shoppe.everybodyisnotdoingit.org
bpabv.nl
edinburghpools.com
altadirezione-consulting.it
www.ijdsir.com
rebeccaosborne.com
ourpreferred.com
ashioke.com
artospace.com
ieltsadd.ir
a1-recruitment.fr
yourhealthyanswer.com
mayingiabao.com
studioambienteterritorio.it
aguiapromocional.com.br
hiperaktivite.info
alburigiott.it
hiro-seiko.com
claudiodituri.it
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

40.79.150.122
20.42.179.204
52.110.12.26
4.230.171.124
52.253.84.76
20.165.94.63
74.179.77.164
20.112.250.133
52.168.117.174
104.46.162.224
40.99.133.210
52.123.128.14
40.99.134.2
20.165.94.46
203.26.79.13
52.123.252.227
85.210.193.152
172.66.2.5
135.233.95.144
48.200.63.27

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report