MALICIOUS — 16153af725ccaf---16802614543.pdf

MALICIOUS — 16153af725ccaf---16802614543.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 266e3a3c6930bb864dc417c8a4af0d477dfab93ba929bdee6033d741bc0a38fb
SHA-1: 80ece0dc798609b43f026796715fc1e9b7f04c39
MD5: 6e5954e5599deee9a899c893a934eb80
ssdeep: 1536:+4GVxWBAIs2lVy0J3U4ZSRzhOhGWHpOvTWzJQwf0hT9PErl9vd:UVQxFy0xU4Zcz8mv9w0hB8r5
TLSH: T14B37C0F3209BDE9C37869B03AAFB615C604AEB8C2623EA508544767C95BD57DBF00940
Submitted as: 16153af725ccaf---16802614543.pdf
File type: pdf · Size: 70648 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 20 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://mwasafat.com/uploads/files/59529365118.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://taptigrihnirman.com/singhania/downloads/file/mofuporolegepiwog.pdf, https://tarsiman.ee/files/file/xisizigulogofowosif.pdf, http://cgpharma.in/cote_dor_import/admin/ckfinder/userfiles/files/tinexifarawuxarorago.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9672 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787776886&P2=404&P3=2&P4=X3h8TVf6mz0CilqPz15itQW5UkyIcxOVkWXI0Au4f3QywemJUDF%2f1x%2bfJYe8v55ehNRXxmQfgh3bj3kmShrPQA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787776965&P2=404&P3=2&P4=VYfZE%2bh%2f3ACBXIXt1vdD%2fWGvq2pXKLshh0iUT0CRV5%2blUgkYkW%2faHU9tVxC0PGAZicPZp9%2fa9OlD5Ht1Cwr2Ew%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\3d01d0aa480695556e5011016e76e99a.png - d72293017f68f34a66fb9f7e061c51040fadd1d028ed91915b1a2915f54883ce
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - c848c0700dbdf4f351bf149924e0fcf8ff311807d8f6d0a6cf782cb787d996f5
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/skout/mBVl/~3/GLLx1DTH0VQ/uplcv?utm_term=use+smartphone+as+touchpad
https://taptigrihnirman.com/singhania/downloads/file/mofuporolegepiwog.pdf
https://tarsiman.ee/files/file/xisizigulogofowosif.pdf
http://cgpharma.in/cote_dor_import/admin/ckfinder/userfiles/files/tinexifarawuxarorago.pdf
https://mwasafat.com/uploads/files/59529365118.pdf
http://kledingindex.nl/images/uploads/71057303722.pdf
http://www.plain-pied.com/editeur/ckfinder/userfiles/files/sewegugoluxuxamujovotep.pdf
http://rusiuojigalvoji.lt/wp-content/plugins/formcraft/file-upload/server/content/files/1614d2ea92077a---kivofizupexesesepuwiw.pdf
http://basaritarim.net/admin/editor_resim/file/93608994068.pdf
http://louisiana-arts.org.s150269.gridserver.com/siteuploads/editorimg/file/rolinebaworesagajemotivep.pdf
https://dermo.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613eaf6f84c2b---garafetom.pdf
http://marketypik.pl/zdjecia/fck/file/71399090056.pdf
http://www.loockuniformes.com.br/home/wp-content/plugins/formcraft/file-upload/server/content/files/16146388317393---68863571430.pdf
http://tamker.hu/userfiles/file/47753889610.pdf
http://www.cpnatacao.pt/backoffice/ckfinder/userfiles/files/bajidis.pdf
http://domki-kopalino.pl/pliki/21974482087.pdf
https://www.stock2morrow.com/ckfinder/userfiles/files/gezobasogofox.pdf
https://www.ibyservice.com/wp-content/plugins/super-forms/uploads/php/files/2be7560e184faad40f8e496b1385dced/nopalivuxotuv.pdf
https://nls.vn/upload/files/nozasus.pdf
http://igabana.com/upfolder/e/files/20210907012605.pdf
http://www.elmundodelapiscina.com/ckfinder/userfiles/files/30541054676.pdf
http://spec-so.ru/sites/default/files/file/rajixobedizazeb.pdf
http://stardentalcare.org/userfiles/file/kogis.pdf
http://www.amedna.com/userfiles/files/dugozuf.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

feedproxy.google.com
taptigrihnirman.com
cgpharma.in
mwasafat.com
kledingindex.nl
www.plain-pied.com
basaritarim.net
louisiana-arts.org.s150269.gridserver.com
dermo.com
marketypik.pl
www.loockuniformes.com.br
domki-kopalino.pl
www.stock2morrow.com
www.ibyservice.com
igabana.com
www.elmundodelapiscina.com
spec-so.ru
stardentalcare.org
www.amedna.com
www.w3.org
purl.org
ns.adobe.com
tarsiman.ee
rusiuojigalvoji.lt
tamker.hu

Embedded IP addresses

135.232.92.137
172.215.188.225
172.172.255.216
51.132.193.105
4.144.132.223
4.230.171.124
203.26.79.13
20.42.65.93
135.233.95.135
135.233.95.144
52.123.129.14
135.233.45.222
52.168.117.171
4.247.188.233
20.184.175.16
52.123.252.194
4.247.188.224
20.184.175.9
20.42.179.192
4.209.250.170

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report