MALICIOUS — 1cc94d8044cebf808f4621f17a08243273eec0de2a656cb18a5be198275671fc

MALICIOUS — 1cc94d8044cebf808f4621f17a08243273eec0de2a656cb18a5be198275671fc is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 1cc94d8044cebf808f4621f17a08243273eec0de2a656cb18a5be198275671fc
SHA-1: 6483e0430743819c1ef51c1e8964b30827fec4ea
MD5: f544a6930f778659bc5104cc4b63b852
ssdeep: 1536:KBhkLZYchM/E/EhwJAyOWC1skkLF9vH9Lf5KJeuWcM8cSMgKY1W8pO70i9:DLZRYEUQAyO/kLF9VdKM6ygKY07t
TLSH: T16937CFF76097DD4C379B9F036AAB1219A4C5E3CD2172EA80918876ACC57C5BCBF04942
Submitted as: 1cc94d8044cebf808f4621f17a08243273eec0de2a656cb18a5be198275671fc
File type: pdf · Size: 73513 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 17 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://kuraniterbiye.com/resimler/files/tizisumasafujiguzokizeki.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://garglob.ru/uplcv?utm_term=no+root+firewall+download, http://7seapharmtech.com/Uploadfiles/files/6823109191.pdf, https://psihodesk.ro/ckfinder/userfiles/files/xupetoxuzamukafopugis.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9595 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\40c4e55aa9494bcf822d801f0067f6b1.png - 5fe8779b3be37b93046a3b83c7114c6044e2ee85b5eaa5fcba527154c1edc875
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 0524a13a2a7f267d614eb62d6623e70eb3eec6673cf9147f6679244a1ac8ef7d
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://garglob.ru/uplcv?utm_term=no+root+firewall+download
http://7seapharmtech.com/Uploadfiles/files/6823109191.pdf
https://psihodesk.ro/ckfinder/userfiles/files/xupetoxuzamukafopugis.pdf
https://laps.pl/userfiles/file/37969172980.pdf
http://hypotekaprezamestnancov.sk/res/file/66863725890.pdf
http://gabortech.com/admin/file/62823918883.pdf
https://fermuar.com/wp-content/plugins/formcraft/file-upload/server/content/files/16140bd871a340---zevagotusa.pdf
https://karatenarrewarren.com.au/ckfinder/userfiles/files/36544536311.pdf
https://habrit.tw/ckfinder/userfiles/files/nixufad.pdf
https://kuraniterbiye.com/resimler/files/tizisumasafujiguzokizeki.pdf
https://llbyggodesign.se/UserFiles/files/mizepi.pdf
https://www.groupe-coelho.fr/ckfinder/userfiles/files/dabuk.pdf
http://sibleyestateplanning.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/farila.pdf
http://carshopm.com/js/upload/files/4090526133.pdf
https://magazinul-de-instalatii-sanitare.ro/app/webroot/files/userfiles/files/vugasegojowogabibamo.pdf
https://srinivasagroup.com/ci/userfiles/files/rerejajanajupujowov.pdf
http://methese.com/upload/files/siritevav.pdf
https://giga-tronics.com/userfiles/files/8924514008.pdf
https://cffcommunications.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1/16136ca848dbb1---55897321381.pdf
http://siblom.ru/files/upload/file/labaxisujozotodixe.pdf
https://interconformity.ro/images/file/53221626004.pdf
http://eastendmediation.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/74155899991.pdf
https://0286869143.com/editor_images/files/nalomidajorisixidapana.pdf
http://ranjitabiswas.com/userfiles/files/bonavotoluduferufif.pdf
http://annabarons.lv/files/files/vovewom.pdf

Embedded domains

garglob.ru
7seapharmtech.com
laps.pl
gabortech.com
fermuar.com
karatenarrewarren.com.au
habrit.tw
kuraniterbiye.com
llbyggodesign.se
www.groupe-coelho.fr
sibleyestateplanning.com
carshopm.com
srinivasagroup.com
methese.com
giga-tronics.com
cffcommunications.nl
siblom.ru
eastendmediation.com
0286869143.com
ranjitabiswas.com
hamzalegalservices.com
www.w3.org
purl.org
ns.adobe.com
psihodesk.ro

Embedded IP addresses

4.150.223.102
4.150.223.111
52.110.12.38
20.42.179.192
4.230.171.124
4.144.132.223
57.154.63.210
74.179.77.204
20.42.65.89
20.112.250.133
52.123.129.14
40.99.133.226
74.178.232.29
203.26.79.13
104.208.16.94
172.170.180.133
4.150.223.112

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report