MALICIOUS — 07793a3b7db49d995185f9f461c971d152192a4ecbd6ae467eb7e8a5cdd726a7

MALICIOUS — 07793a3b7db49d995185f9f461c971d152192a4ecbd6ae467eb7e8a5cdd726a7 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 07793a3b7db49d995185f9f461c971d152192a4ecbd6ae467eb7e8a5cdd726a7
SHA-1: ffed11bcc93e8b4428d7c5b0c962c3948b8a8ef3
MD5: 71d908fd2deecb6363bffd2bef22c2a2
ssdeep: 1536:DEaoOJLITU+OWq8SWpY0ip5c/VGWMP/SG0WspORf5GGKSj:AaoOJLIIfWXpUp5uAP/SGvRfkE
TLSH: T13137CFF32093DC4C778BCB0369FB11B96089D658262BEBA15188B77CC57C6BE6E10611
Submitted as: 07793a3b7db49d995185f9f461c971d152192a4ecbd6ae467eb7e8a5cdd726a7
File type: pdf · Size: 75796 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 20 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://unixsensor.com/uploads/files/202109101804082323.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: http://unixsensor.com/uploads/files/202109101804082323.pdf, https://www.hdcorp.com.br/wp-content/plugins/super-forms/uploads/php/files/sls52rht0hlduqrar5rifjdv5m/78831992557.pdf, https://escritacontabilidade.net/fotos/news/file/61370739888.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9687 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\1a2171acf887ff37bf338120a01a5df0.png - 0d836fd8f09d72e84839f8014c0aa9d57fe0c0c41e21a557cd968e7350e55ff9
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 15ac86a4632c93f243f025ca88228193340b6951bd3edb17b70b3a10a33823f9
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/3CAf4wW3hvY/uplcv?utm_term=best+mobile+under+15000+in+bd
http://unixsensor.com/uploads/files/202109101804082323.pdf
https://www.hdcorp.com.br/wp-content/plugins/super-forms/uploads/php/files/sls52rht0hlduqrar5rifjdv5m/78831992557.pdf
https://escritacontabilidade.net/fotos/news/file/61370739888.pdf
http://innobiztour.com/FileData/ckfinder/files/20210911_17098EAC3A572613.pdf
http://www.opencalgary.org/wp-content/plugins/formcraft/file-upload/server/content/files/1613bea682d85b---wirapebozipure.pdf
http://www.gitialiganjlko.org/ckfinder/userfiles/files/86018373677.pdf
http://shtaket46.ru/page_edit/_samples/userfiles/files/30493732633.pdf
http://rosesrealtyhomes.com/userfiles/files/gebewumevida.pdf
http://limuzine.md/userfiles/file/98222091385.pdf
https://www.rapn.ru/ckfinder/userfiles/files/17624690074.pdf
http://makesomenoise.hu/upload/file/65617850169.pdf
http://inistor.com/ufiles/files/47491746466.pdf
http://sportschoolindex.nl/images/uploads/gikivokozazoj.pdf
https://icrs-as.com/userfiles/file/91865172369.pdf
https://championsforchildren.org/wp-content/plugins/super-forms/uploads/php/files/6e4b3ac302372d4edcdca7e8148c6c5b/xatofovisufewolesefi.pdf
http://chothuexehochiminh.com/userfiles/file/kufega.pdf
http://accurateverdicts.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614202d5693ae---nuxudedelupujobugewopib.pdf
http://turnyras.lt/Files/file/sakumixidozefo.pdf
http://weilandensemble.nl/ckfinder/userfiles/files/pinezu.pdf
http://haithuanphat.com/uploads/files/40024589852.pdf
https://abhimaninteriors.com/ckfinder/userfiles/files/21867506139.pdf
http://indel.sk/userfiles/file/34561123221.pdf
https://buddingheights.org/wp-content/plugins/formcraft/file-upload/server/content/files/16137c2ed5120f---mobikamanalaj.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

feedproxy.google.com
unixsensor.com
www.hdcorp.com.br
escritacontabilidade.net
innobiztour.com
www.opencalgary.org
www.gitialiganjlko.org
shtaket46.ru
rosesrealtyhomes.com
www.rapn.ru
inistor.com
sportschoolindex.nl
icrs-as.com
championsforchildren.org
chothuexehochiminh.com
accurateverdicts.com
weilandensemble.nl
haithuanphat.com
abhimaninteriors.com
buddingheights.org
www.w3.org
purl.org
ns.adobe.com
limuzine.md
makesomenoise.hu

Embedded IP addresses

52.168.112.66
52.168.117.171
172.66.2.5
172.215.188.232
52.110.12.31
4.230.171.124
20.165.94.63
4.150.223.97
52.123.129.14
40.99.133.242
40.103.64.242
135.233.45.222
52.123.252.215
72.145.35.103
203.26.79.13
52.123.252.197
74.178.76.44
92.223.78.30
20.184.175.8
4.209.250.170

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report