MALICIOUS — 21814a2babab33d6b5464d8d937ead1c760578105120437d9c087a749a067456
MALICIOUS — 21814a2babab33d6b5464d8d937ead1c760578105120437d9c087a749a067456 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (86/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
21814a2babab33d6b5464d8d937ead1c760578105120437d9c087a749a067456 - SHA-1:
8ac81d9c8d5e1deb0f4ec7c3cd9238abddab217e - MD5:
3a59f991066e827574a9ea0a4e85ba29 - ssdeep:
1536:Bl9Zuwou4+48/jAFB3Zl/erxuIIIIIIhYgGn0ho5VfcUlV:Bl9noudFcBulqYghKVfVlV - TLSH:
T105368DF711ABDE0C7ACFCF43595B229DA089D7C86232DA409988762D50BC6BE7F10512 - Submitted as: 21814a2babab33d6b5464d8d937ead1c760578105120437d9c087a749a067456
- File type: pdf · Size: 64976 bytes
- Verdict: malicious (86/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
- Microsoft Defender: Phish:PDF/FakeTool.P!MTB
- Emsisoft (Emergency Kit): PDF.Spam.Heur.3
MITRE ATT&CK
Why this verdict
The malicious score of 86/100 is the fusion of 6 weighted signals:
- Dropped a malicious payload (Lazarus): root_.cache_dconf_user - dynamic signal, weight 0.80, confidence 0.90
- Embedded network infrastructure: http://gaminggenerator.org/app/431946152/how-to-upload-music-to-roblox-for-free-2021, http://darruzzo.com/images/how-to-get-free-robux-in-roblox-legit.pdf, http://behsanroshd.com/images/free-obc-roblox-accounts-2021.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Contacted 2 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
998 behavior events · 0 ATT&CK techniques · 2 dropped files.
Runtime network
- desktop-hsgcbep
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- WORKGROUP
- ntp.ubuntu.com
- ff02::1:3
- 224.0.0.252
- 10.240.0.255
- ff02::fb
- 224.0.0.251
- 10.240.0.1
- 239.255.255.250
- ff02::16
- 169.254.255.255
- 224.0.0.22
- 255.255.255.255
- ff02::1:2
- ff02::1
Dropped files
- root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7 - tmp_tmp.seJp4mJGGN -
3d5c6b6a6d6670196e76cc554a1911942432fb1d4547628ff03fa17aa62ebd2a
Embedded URLs
- http://gaminggenerator.org/app/431946152/how-to-upload-music-to-roblox-for-free-2021
- http://darruzzo.com/images/how-to-get-free-robux-in-roblox-legit.pdf
- http://behsanroshd.com/images/free-obc-roblox-accounts-2021.pdf
- http://enjoybabelisland.com/images/how-to-create-a-roblox-hack.pdf
- https://eleganceautospa.ca/images/roblox-hack-scrip.pdf
- http://genialica.de/images/2021-free-robux-generator.pdf
- https://www.mvp.co.nz/images/roblox-gift-card-free-codes-2021.pdf
- http://brusivojimi.com/images/what-is-the-money-cheat-for-roblox.pdf
- http://svp-steinmaur.ch/images/roblox-robux-hack-ipad.pdf
- https://scraperite.com/images/easy-games-to-hack-on-roblox.pdf
- http://www.marambio.com.ar/images/roblox-robux-free-codes-2021.pdf
- http://www.fvsspa.com/images/comment-avoir-tout-les-oblets-free-sur-roblox.pdf
- http://www.cuniv-naama.dz/images/cheat-engine-64-roblox-2021.pdf
- http://pandaplast.com/images/hacks-roblox-yt.pdf
- http://www.fluidtech.hu/images/roblox-change-name-free-pastbin.pdf
- http://www.rezbb.sk/images/catalog-roblox-free.pdf
- http://uctovnictvosnv.sk/images/how-to-hack-roblox-with-winrar-on-windows-10.pdf
- http://www.brtes.com/images/how-to-get-free-robux-2021-no-human-verification-pc.pdf
- http://www.remiauclair.fr/images/free-robux-no-genoater-or-surey.pdf
- https://www.only-press.ru/images/roblox-fly-hacks-roblox.pdf
- http://www.eaapiaria.es/images/free-robux-secret-code.pdf
- http://www.inservis.cl/images/fan-free-games-roblox.pdf
- http://www.pleiadisrl.it/images/how-to-hack-in-silver-in-treelands-roblox.pdf
- https://www.academiaanticorrupcion.org/images/roblox-jailbreak-new-hack.pdf
- http://www.rezbb.sk/images/can-u-make-a-shirt-in-roblox-for-free.pdf
Embedded domains
- gaminggenerator.org
- darruzzo.com
- behsanroshd.com
- enjoybabelisland.com
- eleganceautospa.ca
- genialica.de
- brusivojimi.com
- svp-steinmaur.ch
- scraperite.com
- www.fvsspa.com
- pandaplast.com
- www.brtes.com
- www.remiauclair.fr
- www.only-press.ru
- www.eaapiaria.es
- www.pleiadisrl.it
- www.academiaanticorrupcion.org
- www.cfdcnv.com
- aiyta.com
- yochin.org.tw
- prodent.com.ua
- centraltravel.com
- bf-sozidanie.ru
- accord.kiev.ua
- www.maakherumusic.net
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report