MALICIOUS — 228966ff990c99222539fa9d7c05afa32cd611b66094054bfce105fb1da55ea5
MALICIOUS — 228966ff990c99222539fa9d7c05afa32cd611b66094054bfce105fb1da55ea5 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
228966ff990c99222539fa9d7c05afa32cd611b66094054bfce105fb1da55ea5 - SHA-1:
87868a3daac8a022ed6128bebc710f810c808688 - MD5:
07c7ab43402f4889f6ecc382d1937bc5 - ssdeep:
1536:EUxMQXoBxh8ueWGjewHDlsI+G3wWkNpOPHLqD1Rp/Wj0f0rp9S/:pxMlQqwjyIH1Pop8oEp0 - TLSH:
T13137BEF3709BDC8C739B9F076DB2115D508AD38861A5DB5085C8A2BC897C6BEBF10842 - Submitted as: 228966ff990c99222539fa9d7c05afa32cd611b66094054bfce105fb1da55ea5
- File type: pdf · Size: 72973 bytes
- Verdict: malicious (98/100)
Detections (4 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 7 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: https://toyotaautobody.com/ckfinder/userfiles/files/95980184978.pdf - network signal, weight 0.70, confidence 0.80
- Contacted 18 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://toyotaautobody.com/ckfinder/userfiles/files/95980184978.pdf, https://lescourailleurs.com/upload/editor/file/gadazawotijota.pdf, http://zartmobilia.com/userfiles/file/20210916210231.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
9692 behavior events · 0 ATT&CK techniques · 3 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- c.pki.goog
- ntp.ubuntu.com
- 250.255.255.239.in-addr.arpa
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787784948&P2=404&P3=2&P4=DGJaIRbDfK6RHIPwTZU0SGvyWhTQ8pFUkMlXJ1w4UbJ%2foG5NL%2bIW4krkANadZ%2fxmgjr7WsZQeO6VLlo1tXrR9g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787784981&P2=404&P3=2&P4=mfWZuXDVyEhIAJlv2%2fDO3pCO0tAEcRjIzNywApIT7OXxCRJrCAetbFKUjmYpha9BxjoihUn7yzigN5pfTCTXcw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Dropped files
- C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt -
b3d3848472599084aa337e2b8a0be4e69e767cf97d4fb698d753696f66a9f63b - C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\8303c96c28cf91987180bc13bfb4c7a0.png -
1c848c883f2380bf98e63f8c650a15972a81affeb9712469000da3bfeb2b4943 - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://feedproxy.google.com/~r/Uplcv/~3/zMnd8XtcwSM/uplcv?utm_term=precipitation+type+today
- https://toyotaautobody.com/ckfinder/userfiles/files/95980184978.pdf
- https://lescourailleurs.com/upload/editor/file/gadazawotijota.pdf
- http://zartmobilia.com/userfiles/file/20210916210231.pdf
- http://camara.acessoainformacao.org/uploads/ckfinder/files/44925841810.pdf
- http://www.recetasyconsejos.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613c63b0b39c8---24434483137.pdf
- https://imad0c0.com/js/ckfinder/userfiles/files/ruwifuputizadikapexesimaw.pdf
- https://webshopplus.nl/app/webroot/files/userfiles/files/94441535214.pdf
- https://biroestarsa.hu/uploads/file/98286496124.pdf
- http://nacyc.jp/Upload/file/wikevasag.pdf
- http://oa30us.com/userfiles/file/pubavetejufo.pdf
- http://i-daa-wl.de/userfiles/23709963198.pdf
- http://twozonechickenlasvegas.com/uploads/files/joker.pdf
- http://joelcsimonesq.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/24487242596.pdf
- https://gonguyenkhoi.vn/upload/files/runanatisosijuvu.pdf
- http://www.lasallelille.com/admin/ckfinder/userfiles/files/22410232363.pdf
- https://adikkeempat.com/contents/files/sujipajekotare.pdf
- http://wsp.pl/userfiles/file/duxujise.pdf
- https://malimbe.africa/wp-content/plugins/super-forms/uploads/php/files/c633f4d3ac024d34ddf27b5c1c46faca/81607003764.pdf
- http://www.asap-recruitment.net/upload/file/pepekisezaxudanobim.pdf
- http://abpjseah.news-read.com/upload/files/48238672996.pdf
- https://kingbakerypans.com/userfiles/file/79822953025.pdf
- http://quaretti.it/userfiles/files/zubes.pdf
- http://tsradviseurs.nl/mailing/images/photo/file/mevijirukavezuvebe.pdf
- https://easternresources.net/ckfinder/userfiles/files/6974775523.pdf
Embedded domains
- feedproxy.google.com
- toyotaautobody.com
- lescourailleurs.com
- zartmobilia.com
- camara.acessoainformacao.org
- www.recetasyconsejos.com
- imad0c0.com
- webshopplus.nl
- nacyc.jp
- oa30us.com
- i-daa-wl.de
- twozonechickenlasvegas.com
- joelcsimonesq.com
- www.lasallelille.com
- adikkeempat.com
- wsp.pl
- www.asap-recruitment.net
- abpjseah.news-read.com
- kingbakerypans.com
- quaretti.it
- tsradviseurs.nl
- easternresources.net
- www.w3.org
- purl.org
- ns.adobe.com
Embedded IP addresses
- 52.168.112.67
- 52.123.252.222
- 4.230.171.124
- 72.153.5.138
- 172.215.188.225
- 203.26.79.13
- 20.247.184.197
- 135.232.92.137
- 52.168.117.174
- 52.123.129.14
- 40.99.133.242
- 52.178.17.2
- 20.42.179.204
- 20.184.175.20
- 92.223.78.30
- 142.251.222.227
- 48.192.143.121
- 20.50.73.15
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report