MALICIOUS — 1b093a909cf9cd635dbc590d5263013541126399056093d26d8ad79ec5496746

MALICIOUS — 1b093a909cf9cd635dbc590d5263013541126399056093d26d8ad79ec5496746 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 1b093a909cf9cd635dbc590d5263013541126399056093d26d8ad79ec5496746
SHA-1: d133b06a386faf3861a24f2d55ea470c490df6ed
MD5: ff9cb4b68f524a98dfb87f31aaa3d5b5
ssdeep: 1536:lgBmX309QZRtmpIU2TkNtqDSl02WHpOvpOkjL2WZXXFi5gnQ:R0SZR0mJWt8S6WvpOkjLpsR
TLSH: T1F037C0F7609BEE8C77C7DF0369FA119D6586D68C1222EA9140C8BF6C997C17DAE20440
Submitted as: 1b093a909cf9cd635dbc590d5263013541126399056093d26d8ad79ec5496746
File type: pdf · Size: 71855 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 19 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://www.bash.cl/media/file/mesabeduzeverizukixuvo.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://www.d-table.com/wp-content/plugins/super-forms/uploads/php/files/3b9f51fbe0af16aed32da7c93fb0279b/86556513080.pdf, http://www.bash.cl/media/file/mesabeduzeverizukixuvo.pdf, http://renovfab-menuiserie.com/userfiles/file/19086146902.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9601 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\4110ee81730866be45f2a33ec363c722.png - 54a066455560c5de5dfec598caddcfbacde18c3fcfa58425b19a833ec5bc10fc
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 66b40f2b1bb62a58af8bec1be6e86ecf7ac25265f1cd13db92eea60c26962f5e
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/skout/mBVl/~3/YTWXjIUwRh0/uplcv?utm_term=live+football+tv+app+free
https://www.d-table.com/wp-content/plugins/super-forms/uploads/php/files/3b9f51fbe0af16aed32da7c93fb0279b/86556513080.pdf
http://www.bash.cl/media/file/mesabeduzeverizukixuvo.pdf
http://renovfab-menuiserie.com/userfiles/file/19086146902.pdf
http://www.naturhalles.fr/fckeditor/userfiles/file/zemumemopelesu.pdf
http://recrute.fr/files/files/38892016107.pdf
http://medicaldistri.com/ckfinder_files/files/fudemevezume.pdf
http://chinalabware.es/d/files/zusipet.pdf
http://hzdsbg.com/uploadfile/1631618858.pdf
http://zadonskiy.ru/wp-content/plugins/formcraft/file-upload/server/content/files/161425320c7fc6---xuvewujabekurotaponado.pdf
http://betheaskssd.com/flash/betheaskssd.com/file/pedonirilowivajaleri.pdf
http://agriturismolataggiasca.eu/userfiles/files/1577340672.pdf
http://www.ppk-kp3k.kkp.go.id/ver2/extra/ckfinder/core/connector/php/media/ckfinder/files/dajaxagebinokemoxe.pdf
https://www.simplythebestevents.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1613e0881d9dd7---83735370994.pdf
https://aokman-drive.com/d/files/nolufiteginanozubisovanib.pdf
http://apsencollege.org/test/fckeditor/file/20222188421.pdf
http://factorycontrolprojects.com/userfiles/file/86573354514.pdf
https://www.newhorizonscrisiscenter.org/ckfinder/userfiles/files/92464047328.pdf
http://tecniagua.es/uploads/ckfinder/files/sufozukidegutolum.pdf
http://szjglaw.com/uploadfile/file/2021090614200673499.pdf
http://laros.cz/UserFiles/file/vokis.pdf
https://www.loisirs-auto-occasion.fr/ckfinder/userfiles/files/fesezofuseduvorigoxet.pdf
https://edouardweil.com/userfiles/file/94346767689.pdf
https://asiahealthcaredentalcentre.com/ckfinder/userfiles/files/17960287122.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

feedproxy.google.com
www.d-table.com
renovfab-menuiserie.com
www.naturhalles.fr
recrute.fr
medicaldistri.com
chinalabware.es
hzdsbg.com
zadonskiy.ru
betheaskssd.com
agriturismolataggiasca.eu
www.simplythebestevents.ca
aokman-drive.com
apsencollege.org
factorycontrolprojects.com
www.newhorizonscrisiscenter.org
tecniagua.es
szjglaw.com
www.loisirs-auto-occasion.fr
edouardweil.com
asiahealthcaredentalcentre.com
www.w3.org
purl.org
ns.adobe.com
www.bash.cl

Embedded IP addresses

74.179.71.159
13.69.116.104
40.84.97.4
20.184.175.3
52.123.252.246
52.110.12.28
48.211.4.16
4.230.171.124
52.253.84.76
20.165.94.63
135.233.95.135
74.179.77.204
20.112.250.133
52.123.128.14
135.234.160.247
135.233.95.80
203.26.79.13
92.223.78.30
20.42.65.85

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report