MALICIOUS — 157e8d550e5d1608cbfca2517018ce01a9731207a85d537ba5250fad21982e71

MALICIOUS — 157e8d550e5d1608cbfca2517018ce01a9731207a85d537ba5250fad21982e71 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 157e8d550e5d1608cbfca2517018ce01a9731207a85d537ba5250fad21982e71
SHA-1: b6477b33622174be9a6f42bb67727d3e308030ad
MD5: cb5af72381c4a63fb220140eba2441ec
ssdeep: 1536:CZ9Qcvigu1G7ALcC/R9bWYB1DMuu9hWQpOCLPL:UvyGYc8R9jMX9YCv
TLSH: T14336AFF32057DE8C7B8BDF476AF616D9A087D78C5162AB904088B76C94BCA7DAF00510
Submitted as: 157e8d550e5d1608cbfca2517018ce01a9731207a85d537ba5250fad21982e71
File type: pdf · Size: 69498 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://wmasgroup.com/userfiles/file/letoliralukor.pdf - network signal, weight 0.70, confidence 0.80
Contacted 27 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://catamma.ru/uplcv?utm_term=cities+near+georgetown+ky, https://festivalecolo.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1613bd87eb8fe1---fejibalepibimodemeboxa.pdf, http://detikakdeti.ru/img/file/2223937099.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9617 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
_dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\de80bce44fcf3e26420c74e2e4d00e1d.png - 18598cca325fa4da6aea837aa4e632480d940ad4cd1400bc87bdd86bbac38d6b
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - c050d87423391b239fed0b30d7f35cc90fe836148a1f516866d28f2bfb4b660b
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://catamma.ru/uplcv?utm_term=cities+near+georgetown+ky
https://festivalecolo.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1613bd87eb8fe1---fejibalepibimodemeboxa.pdf
http://detikakdeti.ru/img/file/2223937099.pdf
http://kapfenberger-schuetzenverein.at/userfiles/file/vapirevefadababop.pdf
http://www.nagsa.es/ckfinder/userfiles/files/34313373728.pdf
http://feldbach-tourismus.at/files/lokitukumugotebixepizogij.pdf
http://www.extramas.com/userfiles/files/13412186751.pdf
http://cjmfgx.morefriendship.com/upload/files/1058820969.pdf
http://wmasgroup.com/userfiles/file/letoliralukor.pdf
https://accu-split.com/userfiles/files/jesipomapawevomezorupage.pdf
http://tecresconsolidamentorestauro.it/fck_data/file/lajanali.pdf
http://nesthomes.in/userfiles/file/womasisanazijunaxibuf.pdf
https://fetogram.com/images/upload/files/bonafoke.pdf
https://saftanton.dk/wp-content/plugins/formcraft/file-upload/server/content/files/1613d81de6e85b---88960976140.pdf
https://diphong.com/uploads/19534436828.pdf
https://unibel.pl/pliki/upload/file/sitewogubusijo.pdf
http://gelateriacool.it/userfiles/files/fipevajotisipabebik.pdf
http://plymouth-logs.co.uk/ckfinder/userfiles/files/wipewodurixunuvido.pdf
https://howardsteeves.com/wp-content/plugins/super-forms/uploads/php/files/f42c54719d1de1a12e69ac50ff67ed99/98226062812.pdf
https://na-nule.ru/wp-content/plugins/super-forms/uploads/php/files/fjspnsj836lj0npnrvj1c285f1/33582260834.pdf
http://wienbildarchiv.com/upload_files/files/muguboxixuzoraxaj.pdf
http://cn-junsheng.com/upload/file///202192124148469.pdf
http://osteriailgalloelinnamorata.com/userfiles/files/789495867.pdf
https://812423.situshoki1.com/contents/files/tidabajiniwejib.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

catamma.ru
festivalecolo.ca
detikakdeti.ru
www.nagsa.es
www.extramas.com
cjmfgx.morefriendship.com
wmasgroup.com
accu-split.com
tecresconsolidamentorestauro.it
nesthomes.in
fetogram.com
diphong.com
unibel.pl
gelateriacool.it
plymouth-logs.co.uk
howardsteeves.com
na-nule.ru
wienbildarchiv.com
cn-junsheng.com
osteriailgalloelinnamorata.com
812423.situshoki1.com
www.w3.org
purl.org
ns.adobe.com
kapfenberger-schuetzenverein.at

Embedded IP addresses

20.42.179.192
52.168.117.168
172.172.255.218
48.211.4.16
20.42.179.204
74.179.71.159
4.150.223.114
52.123.252.226
52.110.12.53
52.110.12.10
20.247.184.142
4.230.171.124
85.210.196.11
135.232.92.97
20.231.239.246
74.178.76.128
52.123.129.14
40.99.133.226
172.178.240.161
52.123.252.222
72.154.7.97
203.26.79.13
52.123.252.233
135.233.95.80
4.150.223.112

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report