MALICIOUS — 074b7c2084ed1c3cf06f3dbf25ea024983503b3ca62dd64a85c63f4a442f723b

MALICIOUS — 074b7c2084ed1c3cf06f3dbf25ea024983503b3ca62dd64a85c63f4a442f723b is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 074b7c2084ed1c3cf06f3dbf25ea024983503b3ca62dd64a85c63f4a442f723b
SHA-1: 4c2f21ce3c2155b983c5589a9a70423201383bad
MD5: d6ce4527cc2ada22605a30b724a34b1f
ssdeep: 768:xzkJIt5bcsoFgV06uQLrCrKT/hTTC7eU:xoJItdPuQLrCrqhS7eU
TLSH: T180307CF7505BCC0C7DCE8B4369BA207934DAD6C571729A0295D8366C907CAAE7F00871
Submitted as: 074b7c2084ed1c3cf06f3dbf25ea024983503b3ca62dd64a85c63f4a442f723b
File type: pdf · Size: 36153 bytes
Verdict: malicious (94/100)

Detections (4 of 54 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Microsoft Defender: Trojan:PDF/Phish.CFN!MTB
Emsisoft (Emergency Kit): PDF.Spam.Heur.2
Trellix Stinger (McAfee): PDF/Phish-TWM!D6CE4527CC2A

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 94/100 is the fusion of 9 weighted signals:

Microsoft Defender flagged Trojan:PDF/Phish.CFN!MTB (rule Trojan:PDF/Phish.CFN!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.2 (rule PDF.Spam.Heur.2) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged PDF/Phish-TWM!D6CE4527CC2A (rule PDF/Phish-TWM!D6CE4527CC2A) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://netcdn.co/app/431946152/flame-gg-earn-robux-free-game-hack, http://pustaka.antropologi.fisip.unand.ac.id/repository/roblox-hack-de-robux-2021_GM431946152.pdf, http://pustaka.antropologi.fisip.unand.ac.id/repository/cheat-engine-dragon-ball-z-final-stand-roblox_GM431946152.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Contacted 13 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

994 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
23.40.52.209
23.11.37.157
20.190.167.64
52.123.252.227 AU · Sydney · AS8075 Microsoft Corporation
52.110.12.26 AU · Sydney · AS8075 Microsoft Corporation
23.198.40.44
52.110.12.16 AU · Sydney · AS8075 Microsoft Corporation
4.230.171.124 KR · Seoul · AS8075 Microsoft Corporation
23.33.238.171
23.33.238.103
104.18.33.89 US · San Francisco · AS13335 Cloudflare, Inc.
20.247.185.124 SG · Singapore · AS8075 Microsoft Corporation

Dropped files

root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

http://netcdn.co/app/431946152/flame-gg-earn-robux-free-game-hack
http://pustaka.antropologi.fisip.unand.ac.id/repository/roblox-hack-de-robux-2021_GM431946152.pdf
http://pustaka.antropologi.fisip.unand.ac.id/repository/cheat-engine-dragon-ball-z-final-stand-roblox_GM431946152.pdf
http://pustaka.antropologi.fisip.unand.ac.id/repository/free-tiktok-fans-and-likes_GM835599320.pdf
http://pustaka.antropologi.fisip.unand.ac.id/repository/how-to-get-free-gift-cards-for-roblox_GM431946152.pdf
http://pustaka.antropologi.fisip.unand.ac.id/repository/how-to-hack-roblox-games-2021_GM431946152.pdf
http://pustaka.antropologi.fisip.unand.ac.id/repository/free-robux-no-verification-no-download_GM431946152.pdf
http://pustaka.antropologi.fisip.unand.ac.id/repository/how-to-get-free-robux-no-waiting-2021_GM431946152.pdf
http://pustaka.antropologi.fisip.unand.ac.id/repository/how-to-hack-your-hacked-roblox-account_GM431946152.pdf
http://pustaka.antropologi.fisip.unand.ac.id/repository/roblox-jailbreak-hack-fr_GM431946152.pdf
http://pustaka.antropologi.fisip.unand.ac.id/repository/free-robux-working_GM431946152.pdf
http://pustaka.antropologi.fisip.unand.ac.id/repository/minecraft-hacked-client_GM479516143.pdf
http://pustaka.antropologi.fisip.unand.ac.id/repository/free-tiktok-coins_GM835599320.pdf
http://pustaka.antropologi.fisip.unand.ac.id/repository/how-to-get-free-robux-without-verification_GM431946152.pdf
http://pustaka.antropologi.fisip.unand.ac.id/repository/free-dominus-roblox-catalog_GM431946152.pdf
http://pustaka.antropologi.fisip.unand.ac.id/repository/free-shrek-head-roblox_GM431946152.pdf
http://pustaka.antropologi.fisip.unand.ac.id/repository/new-this-game-actuslly-gives-free-robux_GM431946152.pdf
http://pustaka.antropologi.fisip.unand.ac.id/repository/roblox-dentist-game-online-free-no-download_GM431946152.pdf
http://pustaka.antropologi.fisip.unand.ac.id/repository/site-17-hack-gui-roblox-script_GM431946152.pdf
http://pustaka.antropologi.fisip.unand.ac.id/repository/how-to-hack-survivor-in-roblox-pc_GM431946152.pdf
http://pustaka.antropologi.fisip.unand.ac.id/repository/free-minecraft-website_GM479516143.pdf
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

netcdn.co
d.no
pustaka.antropologi.fisip.unand.ac.id

Embedded IP addresses

51.116.246.106
4.247.188.224
52.123.252.227
52.110.12.26
52.110.12.16
4.230.171.124
104.18.33.89
20.247.185.124
135.233.95.144
92.223.78.30
74.179.77.204
20.42.73.27
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report