MALICIOUS — xuruzorunetix.pdf

MALICIOUS — xuruzorunetix.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100). 4 of 50 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 274db64e99fff7519e12dd7ae4d3fcced78c912021837f9cf4002a7218ee088d
SHA-1: 2ade354636a557d643d36ac74e9bbc35f289e82d
MD5: eb445b851a9617c6b8445154024f0e53
ssdeep: 1536:dpvlN5jU4Sm1LwTmHW3bQ1i9wCfiLW9cvi7CtOMvLWQpOCoWpMz7DENMf:fvh44Sm1E4Wk1ioWC67SZv2C5k7DEK
TLSH: T17438C0F35087DD5C778B9F0379EA116C608AEB845162EE600184A7ACE57CEBC7E14B50
Submitted as: xuruzorunetix.pdf
File type: pdf · Size: 81111 bytes
Verdict: malicious (100/100)

Detections (4 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Lazarus): root_.cache_dconf_user - dynamic signal, weight 0.80, confidence 0.90
Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
Embedded link rated suspicious by URL analysis: http://finproekt-msk.ru/userfiles/file/namoxoxopatezagedaja.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: http://eurolocal.info/sites/default/files/images/file/zoxad.pdf, https://hasekei.jp/userfiles/file/kizosavunu.pdf, https://dipinkrishna.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607cd8bb8444a---49473788317.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Contacted 6 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

1015 behavior events · 0 ATT&CK techniques · 2 dropped files.

Runtime network

250.255.255.239.in-addr.arpa
desktop-hsgcbep
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
ff02::1:3
224.0.0.252
ff02::fb
224.0.0.251
10.240.0.255
10.240.0.1
169.254.255.255
239.255.255.250
172.215.188.232 US · San Antonio · AS8075 Microsoft Limited
172.172.255.216 US · Ashburn · AS8075 Microsoft Limited
255.255.255.255
ff02::1:ff4c:1d1d
ff02::16

Dropped files

root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
tmp_tmp.3ad9Cd91eB - f35ac6172f7173c26f3cc4b98eb0b97796928375ec50ee1b6967559cad887a56

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/ngfLrbzwjls/uplcv?utm_term=ghibli+sheet+music+book+pdf
http://eurolocal.info/sites/default/files/images/file/zoxad.pdf
https://hasekei.jp/userfiles/file/kizosavunu.pdf
https://dipinkrishna.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607cd8bb8444a---49473788317.pdf
http://incucinaconalberta.com/userfiles/files/xeporeferazojimimiregoni.pdf
http://daiduongmetal.com/uploads/ckfinder/files/65147084157.pdf
http://sllight.ru/design/img/upload/file/6105473158.pdf
https://ovistar-dz.com/ckfinder/userfiles/files/ximivig.pdf
https://pinpointfeedtech.com/ckfinder/userfiles/files/92823743051.pdf
http://finproekt-msk.ru/userfiles/file/namoxoxopatezagedaja.pdf
http://orourkelawoffice.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/60858613372.pdf
https://frontivo.ro/userfiles/file/76183685768.pdf
http://phayaotechno.com/UserFiles/File/71419789083.pdf
https://narimasu-chintai.net/jcfiles/file/dorulajitu.pdf
https://www.mercedesbenzofaustinservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/16084aedf64e9d---xefadexejuwu.pdf
https://elitediesel.com.br/ckeditor/ckfinder/userfiles/files/mumuwase.pdf
https://valleyrestoration.net/home/apf/public_html/ckfinder/userfiles/files/soxajizekejugawo.pdf
http://www.moteco.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160a23adb0dac0---rafox.pdf
https://www.darrellstuckey.com/wp-content/plugins/formcraft/file-upload/server/content/files/160e7b89a88834---68470799992.pdf
https://study-abroad-travel.com/ckfinder/userfiles/file/mosodetowon.pdf
https://www.accidentinjuryalbuquerque.com/wp-content/plugins/super-forms/uploads/php/files/i0j5hpfiovodiahiv4lpsoucba/roledofubi.pdf
https://freedomhypnosisnyc.com/wp-content/plugins/super-forms/uploads/php/files/9604173606645ae078730576d11c7920/18632969043.pdf
https://autoprofi.ua/userfiles/file/87737282269.pdf
http://www.cbs-emballages.com/upload/file/palowuwulesoxasutixolido.pdf
https://www.sahabatkeluargahomecare.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612ef44554f37---18035174963.pdf

Embedded domains

feedproxy.google.com
eurolocal.info
hasekei.jp
dipinkrishna.com
incucinaconalberta.com
daiduongmetal.com
sllight.ru
ovistar-dz.com
pinpointfeedtech.com
finproekt-msk.ru
orourkelawoffice.com
phayaotechno.com
narimasu-chintai.net
www.mercedesbenzofaustinservice.com
elitediesel.com.br
valleyrestoration.net
www.darrellstuckey.com
study-abroad-travel.com
www.accidentinjuryalbuquerque.com
freedomhypnosisnyc.com
autoprofi.ua
www.cbs-emballages.com
www.sahabatkeluargahomecare.com
www.w3.org
purl.org

Embedded IP addresses

172.215.188.232
172.172.255.216
135.233.95.144

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report