MALICIOUS — normal_6035811c376b3.pdf

MALICIOUS — normal_6035811c376b3.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 5 of 50 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 1dc670640d5938a5ef14d8122d20176a39d02460d3f4d49dc6e2d5293899fb63
SHA-1: 855c96a22bff05a067daa0da5b4249d7837412c4
MD5: b352799a80404fb65d7fe025cb5e83a6
ssdeep: 1536:g78P/hfwY3IT1SI1TPm4E3gAg7w3nbblVTx7xvUTpk6pKXs1FuR4DhC7IsEz5nvq:SK/GYYT1SI9FE3Vyw33Jdo0Xs1pDw7I4
TLSH: T16737C0B3606BDE8CF696DB436DA7186E748AC2C96136EA4004C47A1CC83C7ED7E16911
Submitted as: normal_6035811c376b3.pdf
File type: pdf · Size: 72886 bytes
Verdict: malicious (99/100)

Detections (5 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!B352799A8040
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Lazarus): root_.cache_dconf_user - dynamic signal, weight 0.80, confidence 0.90
Contacted 29 external host(s) at runtime (7 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://static.s123-cdn-static.com/uploads/4414864/normal_5fcd4413daaef.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://maypoin.ru/123?utm_term=polytropic+process+and+adiabatic+process, http://jimanujomubil.epizy.com/64953898887.pdf, https://cdn.sqhk.co/wepunajexiju/cOehajh/rezabulu.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9575 behavior events · 1 ATT&CK techniques · 4 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e?P1=1787100651&P2=404&P3=2&P4=ByN93kZhDgsGjmTTn%2fGQ1r8xWA828nH3QkBLwVYSW6Pmkm06l7DVzt1yjkYEPm7Q9gcYune1KKDPIaQ9OQaXrA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/58b2a9b1-8570-476c-a7c2-f7ab0a20fbf9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/58b2a9b1-8570-476c-a7c2-f7ab0a20fbf9?P1=1787100706&P2=404&P3=2&P4=ap26L8UOSONFsT3FGU04N8au3PYH3xlNBhta4HTCKAjpSzq%2bm41yp075VGnbTLbz%2bYEzBFPOeWa%2fkSUQoFW6aA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
23.40.52.85
23.11.37.157
20.190.142.166

Dropped files

/opt/CAPEv2/storage/analyses/30985/files/dff1dcc1845809ff68fbeb7e4608c5bb0d950444f587bad467bf6d5683038171 - dff1dcc1845809ff68fbeb7e4608c5bb0d950444f587bad467bf6d5683038171
/opt/CAPEv2/storage/analyses/30985/files/bad0eb0f60ee5f5a5b739135393128096d1a6a8faffbda0a1b84e4c6c496188a - bad0eb0f60ee5f5a5b739135393128096d1a6a8faffbda0a1b84e4c6c496188a
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
tmp_tmp.f5LLkRmhei - bfc1c1f847e4df6e7897dca51f0e6234e78ca67df5fd0103248993714d98308d

Embedded URLs

https://maypoin.ru/123?utm_term=polytropic+process+and+adiabatic+process
http://jimanujomubil.epizy.com/64953898887.pdf
https://cdn.sqhk.co/wepunajexiju/cOehajh/rezabulu.pdf
https://static.s123-cdn-static.com/uploads/4414864/normal_5fcd4413daaef.pdf
http://tevetozenirok.rf.gd/used_ipod_nano_4th_generation.pdf
https://static.s123-cdn-static.com/uploads/4446394/normal_5fec6ab5553a8.pdf
http://bidetorula.rf.gd/first_transformers_movie_bumblebee.pdf
http://tujolelulovowew.rf.gd/molecular_shapes_vsepr_activity_answers.pdf
https://s3.amazonaws.com/mogipegi/mackerel_run_free.pdf
https://cdn-cms.f-static.net/uploads/4415308/normal_6011fb671a8da.pdf
http://madifowagerotal.iblogger.org/6175894465.pdf
https://cdn.sqhk.co/tudusiki/h2jd3qT/clash_of_zombies_heroes_game_apk_download.pdf
http://pakabofenup.epizy.com/zovanozaduramojebosu.pdf
http://getcreditreport.info/69302433487jyp4x.pdf
http://copyrightsupportforlnstagram.com/bmobile_prepaid_plans_trinidad132vh.pdf
http://pabipinipimano.epizy.com/36181394670.pdf
http://mon-cmbretagne.best/top_motown_hits_60_s_70_svghsc.pdf
http://wajines.rf.gd/52727567328.pdf
https://s3.amazonaws.com/vinivuxo/acknowledgement_sample_for_term_paper.pdf
http://redit.fun/sopatefabarafeq60bh.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/

Embedded domains

maypoin.ru
jimanujomubil.epizy.com
cdn.sqhk.co
static.s123-cdn-static.com
s3.amazonaws.com
cdn-cms.f-static.net
madifowagerotal.iblogger.org
pakabofenup.epizy.com
getcreditreport.info
copyrightsupportforlnstagram.com
pabipinipimano.epizy.com
redit.fun
www.w3.org
purl.org
ns.adobe.com
tevetozenirok.rf.gd
bidetorula.rf.gd
tujolelulovowew.rf.gd
mon-cmbretagne.best
wajines.rf.gd

Embedded IP addresses

4.144.132.114
52.110.12.46
4.230.171.124
135.232.92.97
20.112.250.133
74.179.77.204
52.123.129.14
74.178.76.44
203.26.79.13
74.178.240.61
52.148.114.188
142.250.183.35

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report