MALICIOUS — 1cbbea689ba1ab1fb30d96491fdf31499d61e599e3134155ce41be5602c49648

MALICIOUS — 1cbbea689ba1ab1fb30d96491fdf31499d61e599e3134155ce41be5602c49648 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 1cbbea689ba1ab1fb30d96491fdf31499d61e599e3134155ce41be5602c49648
SHA-1: abb7b9e0f3cf47ace6b8683c99bbf0909eda6334
MD5: 5cef4bda0dd01b6d803d42daea9fddd3
ssdeep: 1536:/qUkym/E72WrhG5CEHaDIZbspmdpIQ02CylqEnFqtZHJWOpOaZEWrAHgul7D+Hqx:by/E7/rhG5CE5ZopmdD0XycNjCaZPAHF
TLSH: T1B138D0F330EBED5C36464F0708B741A9654AE7DC1162FFA00144BAAD997CABD7E00992
Submitted as: 1cbbea689ba1ab1fb30d96491fdf31499d61e599e3134155ce41be5602c49648
File type: pdf · Size: 82396 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://www.fan-consultants.com.tw/ezadmin/ckfinder/userfiles/files/42734208498.pdf - network signal, weight 0.70, confidence 0.80
Contacted 22 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://philabc.ru/uplcv?utm_term=view+pdf+on+website, http://templeton.sk/userfiles/file/22454928527.pdf, http://tycoonmedical.com/userfiles/file/94666671645.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9663 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 27d16c4268fc279dd5ee2005640906c9525a129caebbe559954696b9826f6a1c
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\b0b3ca8034fef000aed11639963d5ec7.png - 56d7b4b018d2b0c16868c51866af69d581e8618c0b7f0cc6c3b91cafe29a054b
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://philabc.ru/uplcv?utm_term=view+pdf+on+website
http://templeton.sk/userfiles/file/22454928527.pdf
http://tycoonmedical.com/userfiles/file/94666671645.pdf
https://papersacksfactory.ae/images/bulk_images/files/fiwurufusipar.pdf
http://allefrgycg.news-read.com/upload/files/katonapazivoka.pdf
http://www.phsdcenter.com/temp/js/ckfinder/userfiles/files/manaj.pdf
http://dokumsuzgec.com/userfiles/files/76529147678.pdf
https://people11people.gr/uploads/File/naxeliwufusujoluwiduxusis.pdf
http://www.fan-consultants.com.tw/ezadmin/ckfinder/userfiles/files/42734208498.pdf
https://emotionalgift.com/ckfinder/userfiles/files/xonakimijagubatorofu.pdf
http://brmhn.com/userfiles/file/20210918022108_7movi7.pdf
https://noble-program.site/js/ckfinder/userfiles/files/jofuvora.pdf
http://cuacuonanbinh.com/userfiles/file/patitikositagusezeb.pdf
https://quanghuydulich.vn/img_duhoc/files/45705374917.pdf
http://dsacare.com/admin/uploads/file/45081564485.pdf
http://image.dlib.vn/libedu/news/bachviet/20210922/file/fiwadaxalofigeledax.pdf
http://engineersclasses4competition.com/files/others/mobenojurenezidusekuluv.pdf
https://ecoverservice.be/gallery/file/pewijorifuvuzugada.pdf
http://papinchess.ru/userfiles/file/10642824904.pdf
https://khabul.mn/mmpa/userfiles/files/49566125411.pdf
https://khoahoc.timviec365.com/picturesfiles/19638468048.pdf
https://banderlogclub.ru/Files/file/37115911588.pdf
http://af.ssla.ru/images/fornews/files/65212541719.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/

Embedded domains

philabc.ru
tycoonmedical.com
allefrgycg.news-read.com
www.phsdcenter.com
dokumsuzgec.com
www.fan-consultants.com.tw
emotionalgift.com
brmhn.com
noble-program.site
cuacuonanbinh.com
dsacare.com
engineersclasses4competition.com
ecoverservice.be
papinchess.ru
khoahoc.timviec365.com
banderlogclub.ru
af.ssla.ru
www.w3.org
purl.org
ns.adobe.com
templeton.sk
papersacksfactory.ae
people11people.gr
quanghuydulich.vn
image.dlib.vn

Embedded IP addresses

57.155.104.224
172.66.2.5
20.184.175.21
52.110.12.14
172.215.188.225
4.230.171.124
40.84.97.4
162.159.142.9
92.223.78.30
74.178.76.54
52.123.128.14
52.123.129.14
13.89.179.12
135.234.160.246
20.165.94.63
72.153.5.132
203.26.79.13
52.123.252.235
52.168.117.170
135.233.45.221
172.170.180.133
40.79.167.10

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report