MALICIOUS — what_is_included_in_an_hr_audit.pdf

MALICIOUS — what_is_included_in_an_hr_audit.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 214d77e49ceabcc0dd4b7d0ba2d70c3bbec23c56bcbb38d98fa94276537b9243
SHA-1: 49ed1fa0864efc05b625275b07781adeaaedc582
MD5: 98d05dceeebb455c7f39c86bf24ec295
ssdeep: 1536:XEgJu3YQuAqcNywHvWaishI14z43evbqRW3sDzgJ3tBoF2Sx33MuWqxF8/nARAd8:0SuoUywPWl1/evg6izg9w8uWq3BRAK
TLSH: T1DA38D0F3A267EE4C3B834B576DE21529A40AD6946533DBB099457B2CC0BC23E7E14A10
Submitted as: what_is_included_in_an_hr_audit.pdf
File type: pdf · Size: 81707 bytes
Verdict: malicious (96/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!98D05DCEEEBB
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Contacted 14 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://cdn-cms.f-static.net/uploads/4369487/normal_5fd7d6441f040.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://leonvi.ru/strik?utm_term=what+is+included+in+an+hr+audit, http://damikofem.rf.gd/nefipa.pdf, https://cdn-cms.f-static.net/uploads/4369487/normal_5fd7d6441f040.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (15 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9672 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep._dosvc._tcp.local
ntp.ubuntu.com
_dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787780560&P2=404&P3=2&P4=Xxc%2fJid7t%2bB23%2bxZOGPNGRyPheI9%2f%2bhtIpEUHGjNMUnfGyybU9U1dJPfeLXqYLsLPjXVcWX0NMbv3TUD%2bcACbA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787780616&P2=404&P3=2&P4=NL4yAvVvaHL2I1r%2b5pflIpj7sqR9aWm9KLGAzDg1NPi5Gt3D%2fIAjmVIZ75PUrj89oVVMBMaDFBDkn5IglLP2Zw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\9c3415c55dc014115e8b8cf7d672fd6d.png - cda4cbb7e016767eac33af738999e494213fc633213147471a6faf5e10605600
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 97c516b0b8c8c721d01dbe636756fc531fee3f1a9a611cb28cba43365fa87705
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://leonvi.ru/strik?utm_term=what+is+included+in+an+hr+audit
http://damikofem.rf.gd/nefipa.pdf
https://cdn-cms.f-static.net/uploads/4369487/normal_5fd7d6441f040.pdf
https://jonewaxuge.weebly.com/uploads/1/3/5/3/135319919/jiput.pdf
http://fodevixitawedur.epizy.com/wizards_and_warriors_nes_manual.pdf
https://cdn.sqhk.co/waxobakal/6v8hdkL/sutipuxafenul.pdf
http://kejidexod.epizy.com/ftb_applied_energistics_2_guide.pdf
https://cdn-cms.f-static.net/uploads/4404965/normal_6022c4447c59b.pdf
https://cdn.sqhk.co/pafevola/ihgyEfT/samsung_internet_browser_download_folder.pdf
https://cdn.sqhk.co/zowonefaso/jhdZN8X/power_equalizer_10-_band_pro_apk.pdf
https://balijijileg.weebly.com/uploads/1/3/4/5/134505585/tirurunenu.pdf
https://nudusomezuriful.weebly.com/uploads/1/3/5/3/135387444/rewavodur.pdf
https://s3.amazonaws.com/zaxawetawupo/44795162548.pdf
http://jukerozugixejad.rf.gd/bostitch_coil_nailer_n66c_manual.pdf
https://cdn-cms.f-static.net/uploads/4448137/normal_600a921331fbc.pdf
http://gepopimasirepav.rf.gd/jupyter_notebook_data_visualization_python_tutorial.pdf
http://woloripovopakop.rf.gd/how_to_pair_philips_universal_remote.pdf
http://tumuxisirawev.rf.gd/adobe_photoshop_cc_android_apk.pdf
http://nowavef.epizy.com/51076405808.pdf
https://s3.amazonaws.com/gixawetopoli/letter_of_recommendation_template_microsoft_word.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/

Embedded domains

leonvi.ru
cdn-cms.f-static.net
jonewaxuge.weebly.com
fodevixitawedur.epizy.com
cdn.sqhk.co
kejidexod.epizy.com
balijijileg.weebly.com
nudusomezuriful.weebly.com
s3.amazonaws.com
nowavef.epizy.com
www.w3.org
purl.org
ns.adobe.com
damikofem.rf.gd
jukerozugixejad.rf.gd
gepopimasirepav.rf.gd
woloripovopakop.rf.gd
tumuxisirawev.rf.gd

Embedded IP addresses

4.247.188.224
74.178.240.61
172.66.2.5
52.110.12.42
52.110.12.45
4.230.171.124
51.116.246.106
135.232.92.137
72.154.7.16
203.26.79.13
52.123.128.14
40.103.64.242
4.150.223.107
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report