MALICIOUS — walking_dead_comics_new_world_order.pdf

MALICIOUS — walking_dead_comics_new_world_order.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 15cd89e63c1b82b62a8613d696943c7ed1879a35543ee27a3a2b5af9c4e4e478
SHA-1: 56a1da76354732916aabd26cffcef56c827c85d7
MD5: f1612a47c36e29da916b573b8caef3aa
ssdeep: 1536:qFJ4v5M6/0NYjQN3fCS7FF1Y/4fh01FQ9pGw2DglfTSz2Iv5WG2X/mO3UEBAg1/T:Lv5M68ijvUF7Yf3Q9kQlM2IcG2/mhESM
TLSH: T18439CFF33097DD1CB69B9F87ADA6256D64C9D38C7072876000887B2CC8BCAAE7E50541
Submitted as: walking_dead_comics_new_world_order.pdf
File type: pdf · Size: 84346 bytes
Verdict: malicious (96/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!F1612A47C36E
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 17 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://gramnews.xyz/balance_sheet_request_letterdns13.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://leonvi.ru/strik?utm_term=walking+dead+comics+new+world+order, https://static.s123-cdn-static.com/uploads/4380210/normal_5fdf595fc80cb.pdf, http://energierecrute-emplois.com/missionaries_of_charity_nyc1jmai.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9638 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
250.255.255.239.in-addr.arpa
ntp.ubuntu.com
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\a5270d2860bf64278a4d7c1e6e07be58.png - 25168ac04052f8ec8abdc94b41e1407a99d6be004747b0fbf9292ca5ff896a5d
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 035ed000ca7c2eb6ef68cf1995c42a80f6313cea63798cb49b617a3f79ed6de8
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://leonvi.ru/strik?utm_term=walking+dead+comics+new+world+order
https://static.s123-cdn-static.com/uploads/4380210/normal_5fdf595fc80cb.pdf
http://energierecrute-emplois.com/missionaries_of_charity_nyc1jmai.pdf
http://talakukatutevib.epizy.com/11052900558.pdf
http://g2am2e.xyz/92646641417szblu.pdf
http://gramnews.xyz/balance_sheet_request_letterdns13.pdf
http://zoomita.fun/25193181779i9yev.pdf
https://cdn-cms.f-static.net/uploads/4393761/normal_603418a26a83f.pdf
http://weex.info/gadapowifijuvusilokot8xg4t.pdf
https://cdn.sqhk.co/jokufemij/hrvT3ZX/25135162295.pdf
https://cdn.sqhk.co/nogorodizet/pXhiiit/nedawijiregavuwubenaji.pdf
https://cdn-cms.f-static.net/uploads/4408997/normal_5fe73dc7eccd1.pdf
http://xinudetozarerip.22web.org/how_to_get_your_real_estate_license_in_arizona_online.pdf
http://tgesheff.xyz/npr_one_app0e9lp.pdf
https://static.s123-cdn-static.com/uploads/4480884/normal_5ffce438a31ac.pdf
http://pollsexpert.com/vazatonukt0mlz.pdf
https://cdn.sqhk.co/duxadikoti/hc3gdjh/75262716180.pdf
http://amaryllis.space/90s_dance_house_music_playlistaolop.pdf
https://cdn-cms.f-static.net/uploads/4402488/normal_601a621471e4a.pdf
http://muzoc.xyz/35770117580y73vl.pdf
http://degivenumi.epizy.com/penadudaxixoxirulibikon.pdf
https://cdn-cms.f-static.net/uploads/4388629/normal_6021e9042e45d.pdf
http://mebelrostov.ru/67155337762zoh65.pdf
http://jeromipaxipuda.rf.gd/o_reilly_books_python_free.pdf
https://static.s123-cdn-static.com/uploads/4505125/normal_5ffe8c486f36e.pdf

Embedded domains

leonvi.ru
static.s123-cdn-static.com
energierecrute-emplois.com
talakukatutevib.epizy.com
g2am2e.xyz
gramnews.xyz
zoomita.fun
cdn-cms.f-static.net
weex.info
cdn.sqhk.co
xinudetozarerip.22web.org
tgesheff.xyz
pollsexpert.com
amaryllis.space
muzoc.xyz
degivenumi.epizy.com
mebelrostov.ru
pazobano.iblogger.org
www.w3.org
purl.org
ns.adobe.com
jeromipaxipuda.rf.gd

Embedded IP addresses

74.179.71.159
4.247.188.233
52.110.12.2
4.230.171.124
52.253.84.76
135.233.95.144
135.233.95.135
52.123.129.14
172.178.240.161
52.123.252.229
72.154.7.108
203.26.79.13
52.123.252.227
92.223.78.30
13.69.109.131
48.199.12.1
51.11.192.49

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report