MALICIOUS — 12f1059bc6fab75a416340a2687081a9cb87c30dd0cbe473d6e5534018801205

MALICIOUS — 12f1059bc6fab75a416340a2687081a9cb87c30dd0cbe473d6e5534018801205 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 12f1059bc6fab75a416340a2687081a9cb87c30dd0cbe473d6e5534018801205
SHA-1: 610913aeb712e3d3d8cca95fdca85d2493222028
MD5: 9bd21eeb8b219ec03e823eb73ed0e853
ssdeep: 1536:dIaO4Ow26OdNxL1dG0slSPbwYiffLWHpOvNcEQRxLc6WHR9kQdboopBurQ:uUOYO/9G0slSPbMfxvNgRxLcZ1dbtpB3
TLSH: T10838CFF35087EC4C734ADB436AA615AD7087D7C87123DA900088A77CA5BC9BDBF14A60
Submitted as: 12f1059bc6fab75a416340a2687081a9cb87c30dd0cbe473d6e5534018801205
File type: pdf · Size: 79963 bytes
Verdict: malicious (95/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 95/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 15 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://synerhu.ru/uplcv?utm_term=sword+art+online+season+3+tagalog+dub, http://graphicon.hu/wp-content/plugins/formcraft/file-upload/server/content/files/1614843006b758---17568531721.pdf, http://pijntherapie.be/uploads/files/65537319872.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9626 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 5cfb18db1943ce4e992b47d92e883da28a84e3b78fe94bfa48772481bf4f8ad8
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\7a9119d98ddf41b99ea043868a3ea92e.png - d6a63bf05f57975bf830718002456f6b4c985d369f0f4e5d4eff028be2049e21
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://synerhu.ru/uplcv?utm_term=sword+art+online+season+3+tagalog+dub
http://graphicon.hu/wp-content/plugins/formcraft/file-upload/server/content/files/1614843006b758---17568531721.pdf
http://pijntherapie.be/uploads/files/65537319872.pdf
https://baruipur.org/ckfinder/userfiles/files/94202313264.pdf
http://classicalgardenfountains.com/uplds/file/powedikutoxinivavimab.pdf
http://we2meeting.com/ckfinder/userfiles/publics/files/10273031260.pdf
https://bazab.ru/ckfinder/userfiles/files/dekaporabanutasinowubipon.pdf
http://goref.ru/files/file/9482670083.pdf
https://emergent-partners.com/wp-content/plugins/formcraft/file-upload/server/content/files/16135787c34a69---munuji.pdf
https://cribpointonline.org/cribpointonline/userimages/file/surikibasitutarakotu.pdf
http://wienbildarchiv.com/upload_files/files/jetutiwevozirenavik.pdf
http://www.armstrongre.com/files/files/zitetewakezugegetizekilim.pdf
http://marklaliberte.com/fckupload/file/widaxosa.pdf
https://costumeworld.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614f069639720---tinuvapegigu.pdf
https://orkhaconstruction.com/wp-content/plugins/super-forms/uploads/php/files/beo7captdu68rh6tdci7fi43ms/manikexiweranada.pdf
https://www.pal-kont.hu/wp-content/plugins/super-forms/uploads/php/files/6f4918c1c788e7d3e1a44e8bfe0479cc/4856388715.pdf
https://civilkontroll.hu/uploads/file/xepegujukivovegabaxuz.pdf
https://europacreativaeuskadi.eu/files/galeria/files/xukarokopuzozanir.pdf
http://rafaelstore.ru/upload/files/56746376021.pdf
http://adance0112.com/upfile/editor/file/64702541705.pdf
http://yesilderecine.com/admin/editor_resim/file/sebevoxawur.pdf
http://muzycznescyzoryki.pl/userfiles/file/35059576630.pdf
https://hockeymro.ca/docs/file/medejurakijovuli.pdf
http://www.peplex.it/wp-content/plugins/formcraft/file-upload/server/content/files/1613a09e1bdf21---nugevumazela.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

synerhu.ru
pijntherapie.be
baruipur.org
classicalgardenfountains.com
we2meeting.com
bazab.ru
goref.ru
emergent-partners.com
cribpointonline.org
wienbildarchiv.com
www.armstrongre.com
marklaliberte.com
costumeworld.com
orkhaconstruction.com
europacreativaeuskadi.eu
rafaelstore.ru
adance0112.com
yesilderecine.com
muzycznescyzoryki.pl
hockeymro.ca
www.peplex.it
www.w3.org
purl.org
ns.adobe.com
graphicon.hu

Embedded IP addresses

4.150.223.107
52.123.252.229
52.110.12.31
135.232.92.34
4.230.171.124
72.154.7.113
203.26.79.13
74.178.76.128
20.165.94.54
52.123.128.14
52.123.252.238
135.234.160.244
20.42.65.84
48.200.63.27
52.178.17.234

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report