MALICIOUS — 151bb350eeb59b8a5526c6771d5f4bc8223c04dbfd0bc95daeed2dbe544b811a

MALICIOUS — 151bb350eeb59b8a5526c6771d5f4bc8223c04dbfd0bc95daeed2dbe544b811a is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 151bb350eeb59b8a5526c6771d5f4bc8223c04dbfd0bc95daeed2dbe544b811a
• SHA-1: 3ae19450e619485f633def1e9e016d8aa26ddd3a
• MD5: d4ce35d00bff8be5e35b9d70517c8740
• ssdeep: 1536:AS6l/iy4ZgUgffCKDrfuO5bPKbz0+bQ2hqJdp962LXE/Q2kV2nV:V8iy43gPlM0+bQiqJdG27E/QtVo
• TLSH: T15237D0B7605BCD9CB9878F437AEA366C3042D1887172DAB06498776CD4EC6BC6E14D20
• Submitted as: 151bb350eeb59b8a5526c6771d5f4bc8223c04dbfd0bc95daeed2dbe544b811a
• File type: pdf · Size: 74258 bytes
• Verdict: malicious (98/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!D4CE35D00BFF
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1105
• T1566.002

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated malicious by URL analysis: http://beiwendq.com/userfiles/file/93563698571.pdf - network signal, weight 0.70, confidence 0.80
• Contacted 20 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
• Embedded network infrastructure: http://www.x454.com/wp-content/plugins/super-forms/uploads/php/files/ajnjt19i6nl6eg8u7acj6mmn13/siwikifugukof.pdf, http://sarljarry.fr/userfiles/file/kopadavavetifif.pdf, http://www.xpresswedding.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b919313ee7c---dafekuruwugasubexo.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9770 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• c.pki.goog
• ntp.ubuntu.com
• 250.255.255.239.in-addr.arpa
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787828481&P2=404&P3=2&P4=NfLseXKTN2GmYiMUi6mbNvRv5LEnAv7XsfcOsso%2fxebCsoWkX29FNX7IhIlLyDRDXFwbhv1dBrzysBJgEwyVHA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787828518&P2=404&P3=2&P4=e%2b%2bKHN6FWcg52pFfvMCpm6JYIDR6pdjY1wXHgZe3zl75mHaETyGgZNs3UvQ%2b8Kj13pLuU7VazlfVEEdqr6jFOA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

• C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 7b73d3cdee1ead1b8ea6538467fc884c2f2a0920f395114d34e4b722dd0288fc
• C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\b25e32f83dc02ae628f5023ee53a3df5.png - 194c4c33090a246750f610ddf4abbc8db8052e78781d8497c4ff7179432358cf
• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://feedproxy.google.com/~r/Uplcv/~3/BkSY9tpko7c/uplcv?utm_term=photobook+template+indesign+free
• http://www.x454.com/wp-content/plugins/super-forms/uploads/php/files/ajnjt19i6nl6eg8u7acj6mmn13/siwikifugukof.pdf
• http://sarljarry.fr/userfiles/file/kopadavavetifif.pdf
• http://www.xpresswedding.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b919313ee7c---dafekuruwugasubexo.pdf
• http://renovfab-menuiserie.com/userfiles/file/felilirodakurerezibunab.pdf
• http://beiwendq.com/userfiles/file/93563698571.pdf
• http://citescolairedeledit.com/include/file/mepes.pdf
• https://madopin.com/calisma2/files/uploads/6719871359.pdf
• http://ptk-astana.kz/wp-content/plugins/super-forms/uploads/php/files/1b065eabc0cdac10ed3ef75ac08bbab3/98053779373.pdf
• https://www.gml.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607a431e904da---sowapasupososav.pdf
• http://shsclassof1959.com/clients/a/a7/a7a82b2a6025f7fafce5d77be70bf845/File/98335070588.pdf
• http://thedewakohchang.com/image/upload/File/ofepulawesadodobefuvod.pdf
• http://www.next-conseil.fr/wp-content/plugins/formcraft/file-upload/server/content/files/160743849caa5e---10986075514.pdf
• http://daisytalavera.com/userfiles/files/77937945586.pdf
• https://rosemonttherapy.health/wp-content/plugins/super-forms/uploads/php/files/srq9bgsma6uevv676j91utm8qn/wolaze.pdf
• https://bibliothequedesarts.ch/ckfinder/userfiles/files/4279174293.pdf
• http://photographybynami.com/wp-content/plugins/formcraft/file-upload/server/content/files/160708f2061130---36606312547.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Embedded domains

• feedproxy.google.com
• www.x454.com
• sarljarry.fr
• www.xpresswedding.com
• renovfab-menuiserie.com
• beiwendq.com
• citescolairedeledit.com
• madopin.com
• www.gml.de
• shsclassof1959.com
• thedewakohchang.com
• www.next-conseil.fr
• daisytalavera.com
• bibliothequedesarts.ch
• photographybynami.com
• www.w3.org
• purl.org
• ns.adobe.com
• ptk-astana.kz
• rosemonttherapy.health

Embedded IP addresses

• 162.159.142.9
• 52.123.252.232
• 40.84.97.4
• 52.110.12.52
• 4.230.171.124
• 20.247.185.124
• 135.233.95.135
• 74.179.77.204
• 20.184.175.8
• 52.123.128.14
• 40.104.4.2
• 52.123.252.238
• 72.145.35.102
• 203.26.79.13
• 74.179.71.159
• 172.217.25.195
• 172.170.180.133
• 51.116.253.168
• 20.42.65.88
• 52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report