MALICIOUS — 1e4d2ec446fa497946992a7b7f4ad090cbe58d2d62714dbf51734fee2c155895

MALICIOUS — 1e4d2ec446fa497946992a7b7f4ad090cbe58d2d62714dbf51734fee2c155895 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 1e4d2ec446fa497946992a7b7f4ad090cbe58d2d62714dbf51734fee2c155895
SHA-1: 664604bb6674cc3fba54c980503d5beff17ee608
MD5: 866f68afa12e67f09e1e42ebf965c2a4
ssdeep: 1536:GpLm8cgVLZ8eL7sksR8g8G6MrW8pO+gWq6j3N58li7XL2:cm8NL8vkw8vMy+B5588m
TLSH: T19837BFF321A3DD8CB34E8B137EA6126DA44AD788A273E7501088776DD5BC57EBE00641
Submitted as: 1e4d2ec446fa497946992a7b7f4ad090cbe58d2d62714dbf51734fee2c155895
File type: pdf · Size: 74496 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://tjchenxing.com/filespath/files/20211001050751.pdf - network signal, weight 0.70, confidence 0.80
Contacted 19 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://parfumerieindex.nl/images/uploads/razukubezufonakateweza.pdf, http://quaint-house.com/images/blog/file/2181583180.pdf, http://www.brennholz-heinlein.de/wp-content/plugins/formcraft/file-upload/server/content/files/161561ab0b126c---99110822606.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9606 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
_dosvc._tcp.local
desktop-hsgcbep
ntp.ubuntu.com
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 742b3e71ff43c390d815587f7f62ef61c916adb886f9eb4d0ceeebaa172dbdc8
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\3dd6270aa05d3c071c6f480ce9e0bb01.png - 535694279e981570be0a244c387de843141cdf069e09fa09d70b53c6b4fb1f79
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/6naE_Nh8_CY/uplcv?utm_term=turn+off+battery+saver+android
http://parfumerieindex.nl/images/uploads/razukubezufonakateweza.pdf
http://quaint-house.com/images/blog/file/2181583180.pdf
http://www.brennholz-heinlein.de/wp-content/plugins/formcraft/file-upload/server/content/files/161561ab0b126c---99110822606.pdf
https://chinese-wall.tw/upload/files/69860229855.pdf
http://cupta.org/userfiles/files/20210908163229.pdf
http://chinajessie.com/seadata/data/uploads/img/file/163260844357.pdf
https://lifesmart.lifesmart.ro/ckfinder/userfiles/files/53149211318.pdf
https://damiel.eu/userfiles/file/lutezukuvufemepigu.pdf
http://tjchenxing.com/filespath/files/20211001050751.pdf
http://purepassion.pl/userfiles/file/tagetawosudojemibizile.pdf
http://buyyoutubesubscribers.com/ci/userfiles/files/mewamejipiru.pdf
http://quaretti.it/userfiles/files/varawaje.pdf
http://originalbau.hu/imagesfiles/15034672422.pdf
http://praguynakorn.com/praguynakorn/picture/datapro/files/jegonizezirigexobelamewo.pdf
https://nidi.mk/ckfinder/userfiles/files/32385664062.pdf
http://benthanhsgfarm.net/images/uploads/files/tunudotadevozitapo.pdf
http://smart.sut.ac.th/tsme/src/lib/ckfinder/userfiles/files/mulakevunojo.pdf
http://www.autoservis-hubatka.cz/admin/upload/ww/file/99081264889.pdf
https://www.sir.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/16155e933a44c1---ginutuxupikar.pdf
https://avis-medical.ma/wp-content/plugins/super-forms/uploads/php/files/dfaf1c8d961d04ab95e0ee84577718ca/71193372266.pdf
http://vaithun.net/upload/files/moxupuzomedu.pdf
http://80tner.netsociality.com/upload/files/55072948561.pdf
https://xeroxexpres.cz/userfiles/file/nukeseredawisilop.pdf
https://pratham.one/file/32706099223.pdf

Embedded domains

l.uk
feedproxy.google.com
parfumerieindex.nl
quaint-house.com
www.brennholz-heinlein.de
chinese-wall.tw
cupta.org
chinajessie.com
damiel.eu
tjchenxing.com
purepassion.pl
buyyoutubesubscribers.com
quaretti.it
praguynakorn.com
benthanhsgfarm.net
www.sir.co.uk
vaithun.net
80tner.netsociality.com
violetstudio.in
www.w3.org
purl.org
ns.adobe.com
lifesmart.lifesmart.ro
originalbau.hu
nidi.mk

Embedded IP addresses

48.211.4.16
13.69.116.108
203.26.79.13
135.232.92.34
52.110.12.24
52.110.12.26
40.84.97.4
4.230.171.124
52.253.84.76
52.123.252.243
74.178.240.61
20.165.94.54
20.112.250.133
52.123.129.14
20.42.65.94
92.223.78.30
48.200.63.27
20.42.65.91
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report