MALICIOUS — 205ec84d04ab378cdedc7da82e229855860a7ea6d61c127bae76b83728938b0a

MALICIOUS — 205ec84d04ab378cdedc7da82e229855860a7ea6d61c127bae76b83728938b0a is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 205ec84d04ab378cdedc7da82e229855860a7ea6d61c127bae76b83728938b0a
SHA-1: 638b732aae828a2d908ee99d7c45aa41f5ac0ed3
MD5: 47176d6501cd7afe6a73bc3a63eb38c0
ssdeep: 3072:1jA1NepzF/l8CRKtN8DApu5UdVtVqU3wYO6Ymwa0:ZA1Ne/98CEk5UNT1Un
TLSH: T19C3BD0F3205BDE0C7A86DF0368F7019C949ACB886172EB54118C7B6CE4BC9BD6E10960
Submitted as: 205ec84d04ab378cdedc7da82e229855860a7ea6d61c127bae76b83728938b0a
File type: pdf · Size: 110495 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://jsptti.com/ckeditor/ckfinder/userfiles/files/96768815440.pdf - network signal, weight 0.70, confidence 0.80
Contacted 18 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://jsptti.com/ckeditor/ckfinder/userfiles/files/96768815440.pdf, http://namuvaldymas.lt/userfiles/file/41800060040.pdf, https://nuregio.de/wp-content/plugins/formcraft/file-upload/server/content/files/16139121636041---vifopuwimisomerali.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9785 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
_dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787917274&P2=404&P3=2&P4=fF6c%2bEQ5AmsI1c%2bkSbbbtkqy6QPMNevKEeQZ5UCSQH1QetBoNkuUe4xL6VyjhgYZOnjlUdZGXbqVoFYnAfeoGA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787917320&P2=404&P3=2&P4=nfKqZhHRwqNL3ZUSw4UQ1T1BcRBNvugB82PA3IxyKU%2bSXzv6Q1wv%2bn8vvuamDOd8KhyGA9rfWs%2bD5lJDgd7qaA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\dafbb66cd6776394fef50300e48c036b.png - e9771efd30dcf84f5f94af93fd4da368a36f812bda4414ec93e9c2a9bbac3570
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - d06394e44defd7591b533ab91d9f7a5cfc95575d03d16001e539a007710a602e
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Gsjc/~3/RC0zOYPQW8A/uplcv?utm_term=no+activity+found+to+handle+intent+install+apk
https://jsptti.com/ckeditor/ckfinder/userfiles/files/96768815440.pdf
http://namuvaldymas.lt/userfiles/file/41800060040.pdf
https://nuregio.de/wp-content/plugins/formcraft/file-upload/server/content/files/16139121636041---vifopuwimisomerali.pdf
http://sl-light.ru/design/img/upload/file/vafowilon.pdf
http://etabetasurvey.com/userfiles/files/dojavokuf.pdf
http://dream-mebel.com/pic/file/ganelewajuxix.pdf
http://bytip.net/filespath/files/20210924045515.pdf
http://rexant.by/upload/editor/files/xejipibetenugukiludowi.pdf
http://pravkniga.ru/files/userfiles/files/52279415406.pdf
http://grani-tonkogo-mira.ru/wp-content/plugins/super-forms/uploads/php/files/efae3e5b51ce14cfb08886c708b6c281/dotonibofabapanaxa.pdf
http://globomax.eu/userfiles/file/fetiluniwidemozoguziki.pdf
http://consulcongress.it/uploads/assets/file/33809685756.pdf
http://dzerzhinsk.timebank.ru/sites/default/files/photos/pagefile/38576700415.pdf
https://hsse.cl/files/beranenujuxar.pdf
http://ylphs.com/ckfinder/userfiles/files/guzafabexol.pdf
http://mgocsm.in/userfiles/file/siguwegejajoxir.pdf
http://tiwtactic.com/userfiles/files/ganotojovoxugijop.pdf
http://schokofontaenen.de/idata/81995100323.pdf
http://lakesnwoodskerala.com/uploads/file/zuvemaxoduzugapal.pdf
http://bhhangkhong.com/upload/images/files/54959270870.pdf
http://www.hgbehringer.de/img/files/files/niwokopobudax.pdf
https://fond.ru/userfiles/file/fovafabovatem.pdf
https://www.sesc.com.ua/wp-content/plugins/super-forms/uploads/php/files/899cstgldhb9375580k99ogdi7/tagelidutanazajukumadokog.pdf
http://almar-bus.pl/userfiles/file/51725734345.pdf

Embedded domains

feedproxy.google.com
jsptti.com
nuregio.de
sl-light.ru
etabetasurvey.com
dream-mebel.com
bytip.net
pravkniga.ru
grani-tonkogo-mira.ru
globomax.eu
consulcongress.it
dzerzhinsk.timebank.ru
ylphs.com
mgocsm.in
tiwtactic.com
schokofontaenen.de
lakesnwoodskerala.com
bhhangkhong.com
www.hgbehringer.de
fond.ru
www.sesc.com.ua
almar-bus.pl
interreg-ipa-husrb.com
tano-cable.com
www.w3.org

Embedded IP addresses

172.66.2.5
92.223.78.30
52.230.60.54
40.84.85.40
52.110.12.55
4.230.171.124
135.232.92.137
20.42.65.89
52.123.128.14
135.233.45.221
52.123.252.192
72.145.35.109
203.26.79.13
4.150.223.114
4.247.188.233
48.199.12.1
13.89.179.15
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report