MALICIOUS — 22c9b2ef4081e95c0763376472f19e25c02917c4733efd95f3539d85d80d9ce8

MALICIOUS — 22c9b2ef4081e95c0763376472f19e25c02917c4733efd95f3539d85d80d9ce8 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 22c9b2ef4081e95c0763376472f19e25c02917c4733efd95f3539d85d80d9ce8
SHA-1: e4b2a0e2274307339e587f5c10cdd2bd57c540ce
MD5: 9d0eaf9e5cc389efb5bb4f8f38040dbf
ssdeep: 1536:rhs2Dvi4IQt+RIfahXF/z1pC5LwCAMHh/WHtbnzi/+UbWQpOCCDh:m9tQs6klz1pCyjA+UGC2
TLSH: T19237BFF3209BDD8CBBC69B0369E7019DA04AD7C86671DF418084B76CD5BC5FEAA00A51
Submitted as: 22c9b2ef4081e95c0763376472f19e25c02917c4733efd95f3539d85d80d9ce8
File type: pdf · Size: 74001 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://indexone.ru/upload/file/bufusutumidenoxafar.pdf - network signal, weight 0.70, confidence 0.80
Contacted 15 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://queure.ru/uplcv?utm_term=head+soccer+android, https://506hlapeta.com/files/file/21884807603.pdf, http://mywayrtk.info/userfiles/file/49076938488.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9574 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - a7b8ca7061b980cf3d3044cf9672a1f22f6209a8598e3cf581dba13e986898c9
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\32749624452926080604b10a9b1bfec0.png - 5d24c161d8908845d063d1bb25412129e1403f9629392bd629f7d0b81348c32c
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://queure.ru/uplcv?utm_term=head+soccer+android
https://506hlapeta.com/files/file/21884807603.pdf
http://mywayrtk.info/userfiles/file/49076938488.pdf
http://jinwoosmc.com/userfiles/file/lokaw.pdf
http://vet-spb.com/userfiles/file/pevovezufememov.pdf
http://bolshunoff.ru/images/wysiwyg/file/pamepapuzov.pdf
http://krakow4you.pl/krakow/files/fezikimanos.pdf
http://indexone.ru/upload/file/bufusutumidenoxafar.pdf
http://halvani.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613656559081d---liwogumesijevujuwor.pdf
http://speednewslive24.com/assets/ckfinder/core/connector/php/uploads/files/jefasisemitof.pdf
http://www.gamylai.vn/uploads/files/sawavowoxonokutepiraluwo.pdf
http://hoachathoanggia.com/userfiles/file/14063375643.pdf
http://bmfjhjk.friend-match.com/upload/files/simikudezolisitewun.pdf
https://radmangroup-ye.com/rgfiles/file/7605854519.pdf
https://aptitudeclass.com/ckfinder/userfiles/files/99639548861.pdf
http://www.temaricerca.com/entry2013new/admindia/ckfinder/userfiles/files/24512769539.pdf
http://machinesupplier.cn/data/product/file/2021918_0518_265.pdf
http://defhjdr.friend-match.com/upload/files/ribipon.pdf
http://profstil.az/userfiles/file/wirijerojona.pdf
http://sgyscom.com/upload_fck/file/2021-9-12/20210912004509196508.pdf
https://webmenuplus.com/images/file/fowojiligikaxafebodoraviw.pdf
http://185.33.116.145/~acus01/upload/files/gejaz.pdf
http://batterseataxi.com/survey/userfiles/files/tumurakadino.pdf
http://furkansigorta.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/16144bf685b139---35378665701.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

queure.ru
506hlapeta.com
mywayrtk.info
jinwoosmc.com
vet-spb.com
bolshunoff.ru
krakow4you.pl
indexone.ru
halvani.com
speednewslive24.com
hoachathoanggia.com
bmfjhjk.friend-match.com
radmangroup-ye.com
aptitudeclass.com
www.temaricerca.com
machinesupplier.cn
defhjdr.friend-match.com
sgyscom.com
webmenuplus.com
batterseataxi.com
www.w3.org
purl.org
ns.adobe.com
www.gamylai.vn
profstil.az

Embedded IP addresses

185.33.116.145
52.123.128.14
20.184.175.9
57.155.101.212
52.110.12.44
57.154.63.210
4.230.171.124
4.144.132.223
72.145.35.104
203.26.79.13
135.233.95.144
40.103.64.226
40.99.134.2
135.234.160.245
52.168.112.67
4.150.223.109

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report