MALICIOUS — 1aa1070cd0c14f43d7fc3a5fbd1bf5010281694cf3b276fa22a3255e61298280

MALICIOUS — 1aa1070cd0c14f43d7fc3a5fbd1bf5010281694cf3b276fa22a3255e61298280 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 1aa1070cd0c14f43d7fc3a5fbd1bf5010281694cf3b276fa22a3255e61298280
SHA-1: 5099cbea9ed263334e29117a88cb02cc7f4447ed
MD5: 27baeeef79918aad996f27ed4c04a18d
ssdeep: 1536:4G5n39BrbvJ1MT7UCCfg0imFjTDGDw5fw7iCaaWd3p08WB0pWspO2Hcld:7bbMHTEximRTDGDsfSjaz3C1B0I2C
TLSH: T1C539C0F321D7DD8CB747DB4759FA019CA086939861A2EBD041C8BABC85BC9BD7B10610
Submitted as: 1aa1070cd0c14f43d7fc3a5fbd1bf5010281694cf3b276fa22a3255e61298280
File type: pdf · Size: 85048 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Contacted 19 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://locnuocvietmy.com/Images_upload/files/5220708117.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: http://locnuocvietmy.com/Images_upload/files/5220708117.pdf, http://photopuzzle.net/userData/board/file/rifexaretesamiwumi.pdf, https://bloc-immo.com/images/fedovopufonagixesapam.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9731 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
_dosvc._tcp.local
desktop-hsgcbep._dosvc._tcp.local
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\60d270ee2085b79f4c8b3416a071c1c5.png - 1a947afd695243284200b36931672f359fbc638f4e546d8ee8d9083c44e1b0a5
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 4192d554ca320fb6e14f1a84d5966dbcd75eca9261d35c107610b56fbce7d1a9
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Gsjc/~3/u-9XGpgKpwY/uplcv?utm_term=start+jade+plant+from+cutting
http://locnuocvietmy.com/Images_upload/files/5220708117.pdf
http://photopuzzle.net/userData/board/file/rifexaretesamiwumi.pdf
https://bloc-immo.com/images/fedovopufonagixesapam.pdf
http://bon-mar.com/fck_user_files/file/42568445933.pdf
http://proallprint.com/userfiles/files/pividozonuta.pdf
http://dobosugyvedkecskemet.hu/userfiles/file/kusizotunog.pdf
http://gajagotour.com/UserFiles/file/37754558856.pdf
https://netcsemege.elelmiszer-hazhozszallitas.hu/ckfinder/userfiles/files/bilariwevajodoxo.pdf
http://www.theagentpipeline.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613959585f234---rozenowojo.pdf
https://sportsht.com/userfiles/file/86171693725.pdf
http://bright-mineral.com/uploadfile/file/2021091101481063.pdf
http://lachina.cn/upload/file/7942794248.pdf
http://uptindia.com/newsimages/file///xowawuletelejanibijupez.pdf
https://quanticabtl.com/cms_2018_quantica/sgi_userfiles/userfiles/files/81412825064.pdf
https://www.amata.org.uk/ckfinder/userfiles/files/36304173479.pdf
http://aqs-group.it/userfiles/files/46231120012.pdf
http://vegasoft.hr/wp-content/plugins/formcraft/file-upload/server/content/files/16136ec9c49e95---934457139.pdf
http://conomiya.com/images/uploadedimages/file/gunisozuriwonokevodu.pdf
http://mdbim.pl/ubezpiecz/obrazy/file/gibufi.pdf
http://zoo-foto.cz/userfiles/file/98512565886.pdf
https://novahealthclinic.ca/userfiles/file/pafejipovubitawukeluzij.pdf
http://driver-jazda.pl/upload/file/juxizekubipav.pdf
http://dorisemitchell.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/gotulikifinowiripiti.pdf
https://www.assessment.unibe.ch/app/webroot/js/ckfinder/userfiles/files/mapijelofi.pdf

Embedded domains

feedproxy.google.com
locnuocvietmy.com
photopuzzle.net
bloc-immo.com
bon-mar.com
proallprint.com
gajagotour.com
www.theagentpipeline.com
sportsht.com
bright-mineral.com
lachina.cn
uptindia.com
quanticabtl.com
www.amata.org.uk
aqs-group.it
conomiya.com
mdbim.pl
novahealthclinic.ca
driver-jazda.pl
dorisemitchell.com
www.assessment.unibe.ch
www.w3.org
purl.org
ns.adobe.com
dobosugyvedkecskemet.hu

Embedded IP addresses

20.42.179.192
57.155.101.212
4.230.171.124
52.230.59.222
51.116.246.105
20.112.250.133
40.99.134.18
52.123.128.14
74.178.240.61
40.104.4.2
135.233.45.223
74.178.76.44
72.145.35.109
203.26.79.13
4.150.223.107
4.150.223.101
52.182.143.212
4.150.223.98
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report