MALICIOUS — 05a31302ad0285b61c64322aa6c20e73543d2946204dbed2f8224c5bb0acbbba

MALICIOUS — 05a31302ad0285b61c64322aa6c20e73543d2946204dbed2f8224c5bb0acbbba is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 05a31302ad0285b61c64322aa6c20e73543d2946204dbed2f8224c5bb0acbbba
SHA-1: 73d955ef3903f4dee5a7130b8a3faf8e00994921
MD5: 1d5187ba95f7df2b417e26442368a188
ssdeep: 1536:FHZZaoVeFD3Ih/os6jfoXNw4O6QKG2ActHVWjJ5UwGU921hWXpO/EWS7BMvJLDv1:hZZaoVex3LwXNw47HRDH0150Z/GwLD9
TLSH: T1A23BE0F321A7ED4C7B524F0379FA1174618ADA842132EFE11489B72CD97C9BCAE50A11
Submitted as: 05a31302ad0285b61c64322aa6c20e73543d2946204dbed2f8224c5bb0acbbba
File type: pdf · Size: 102786 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://www.darvidproperty.com/news/file/63182143681.pdf - network signal, weight 0.70, confidence 0.80
Contacted 16 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://markzone.az/wp-content/plugins/super-forms/uploads/php/files/fnte951nkglsc99vgiu06pn81h/62667635874.pdf, http://brmhn.com/userfiles/file/20210802031029_ggxn5n.pdf, http://otestmanager.com/club/data/userfiles/file/20210831081528.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9694 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
ntp.ubuntu.com
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\df5e81cfd6e26a45c937f02e68aea825.png - b9a8fc20cbd2acc066c29df8be19a45e60c14440a3e9ebddcf6d12ee59221aad
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 059f07392aacb6caa85d44032278fe825c0fb6563f354b5aad140e876788f512
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/LPIa9PGmDLg/uplcv?utm_term=black+clover+charmy+pappitson
https://markzone.az/wp-content/plugins/super-forms/uploads/php/files/fnte951nkglsc99vgiu06pn81h/62667635874.pdf
http://brmhn.com/userfiles/file/20210802031029_ggxn5n.pdf
http://otestmanager.com/club/data/userfiles/file/20210831081528.pdf
https://skazkavdom.com/wp-content/plugins/super-forms/uploads/php/files/ffd9de89af9dc029a4907b5fffc4509b/43189208475.pdf
https://popcouncilinstitute.org/wp-content/plugins/super-forms/uploads/php/files/fe470a3dc1b2224ee957ce8980f307b7/12673489815.pdf
https://www.ideaklinik.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607b4adde0a22---mukixawolubadikomifewatin.pdf
http://www.sunargrup.com.tr/wp-content/plugins/super-forms/uploads/php/files/j6hr1qg21uuc7safn8i70li2s3/40481126462.pdf
http://www.darvidproperty.com/news/file/63182143681.pdf
https://medtek.vn/storage/file/vebotafedewitegele.pdf
http://perksys.com/userfiles/file/satoxakuzexivakakak.pdf
https://hongmao.tw/uploads/files/202108210551366800.pdf
http://abapaposentados.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1607d432fe20f9---gigejisamomunajegututaj.pdf
http://exteractif.fr/pictures/2/75642845476.pdf
http://www.nowsingapore.co.id/wp-content/plugins/formcraft/file-upload/server/content/files/160ac3eaabaa5f---vawixonobifobekekezeg.pdf
https://konferencii.ru/js/ckfinder/userfiles/files/kosarozetoxuwugem.pdf
http://lpkgoodframeupvc.com/userfiles/files/newumizozawidape.pdf
http://12shio5.com/contents//files/10044521930.pdf
https://taevlingar.se/images/pages/file/31536596991.pdf
http://www.segurosfacility.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1608e67af93a51---57022358223.pdf
http://www.gametimecatering.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d95d76604a---75012189409.pdf
http://aaaexpressheating.com/userfiles/file/nujatikam.pdf
https://www.darrellstuckey.com/wp-content/plugins/formcraft/file-upload/server/content/files/160767eeaecd9a---70170410479.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/

Embedded domains

feedproxy.google.com
brmhn.com
otestmanager.com
skazkavdom.com
popcouncilinstitute.org
www.ideaklinik.com
www.darvidproperty.com
perksys.com
hongmao.tw
abapaposentados.com.br
exteractif.fr
konferencii.ru
lpkgoodframeupvc.com
12shio5.com
taevlingar.se
www.segurosfacility.com.br
www.gametimecatering.com
aaaexpressheating.com
www.darrellstuckey.com
www.w3.org
purl.org
ns.adobe.com
markzone.az
www.sunargrup.com.tr
medtek.vn

Embedded IP addresses

20.184.175.10
13.69.109.131
92.223.78.30
162.159.142.9
4.150.223.102
52.110.12.32
57.154.63.210
4.230.171.124
52.230.59.222
4.150.223.100
20.112.250.133
74.178.76.128
52.123.128.14
52.123.252.240
72.154.7.109
203.26.79.13

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report