MALICIOUS — 2787242f42b006880cf4da0a9917a7d9b3a0becc77e3d1d56c4bebf8cf4fb000

MALICIOUS — 2787242f42b006880cf4da0a9917a7d9b3a0becc77e3d1d56c4bebf8cf4fb000 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100). 5 of 54 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 2787242f42b006880cf4da0a9917a7d9b3a0becc77e3d1d56c4bebf8cf4fb000
• SHA-1: 6a6f270056dc30283c8cca87dcafee56ae23847a
• MD5: f900b923fc463a089c4c38141e6409af
• ssdeep: 1536:GgAigbA09GDomZWsXs6y7T+rKprjfw0DpgvBZIqHw9I3:fAhHMkHsSOKpXfw02ZIqwm
• TLSH: T1E637D0F350ABED4C6A93AB439D92066C7849C3482933DB5058D836BEC9F867DBF00941
• Submitted as: 2787242f42b006880cf4da0a9917a7d9b3a0becc77e3d1d56c4bebf8cf4fb000
• File type: pdf · Size: 74333 bytes
• Verdict: malicious (100/100)

Detections (5 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!F900B923FC46
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1105
• T1566.002

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged PDF/Phish-FAB!F900B923FC46 (rule PDF/Phish-FAB!F900B923FC46) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
• Contacted 6 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded link rated suspicious by URL analysis: http://www.brennholz-heinlein.de/wp-content/plugins/formcraft/file-upload/server/content/files/160933a7186d3c---zogemogudafedinifavov.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: http://soflocops.com/clients/67403/File/82392404610.pdf, https://www.alongsideasia.com/wp-content/plugins/super-forms/uploads/php/files/eaedf0f554cc986ec02fe0194bf60df8/pomajor.pdf, http://1utilaje.ro/mm/file/risisogawoso.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

1079 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• ntp.ubuntu.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
• http://yr.c.lencr.org/
• 23.40.52.209
• 23.11.37.157
• 20.190.142.166

Dropped files

• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/BkSY9tpko7c/uplcv?utm_term=pokemon+fire+red+cheats+of+pokemon
• http://soflocops.com/clients/67403/File/82392404610.pdf
• https://www.alongsideasia.com/wp-content/plugins/super-forms/uploads/php/files/eaedf0f554cc986ec02fe0194bf60df8/pomajor.pdf
• http://1utilaje.ro/mm/file/risisogawoso.pdf
• http://bestbuyfromindia.com/userfiles/file/50068905133.pdf
• http://www.johnknox.ch/wp-content/plugins/formcraft/file-upload/server/content/files/1608a1189c1f69---dikor.pdf
• http://arci-mp.fr/admin/File/fumifuvavogomuduwetave.pdf
• https://bellevuecommunityfoodbank.org/wp-content/plugins/super-forms/uploads/php/files/675a8719a068fdb8f41b5a679dc49cc6/41739578442.pdf
• http://www.brennholz-heinlein.de/wp-content/plugins/formcraft/file-upload/server/content/files/160933a7186d3c---zogemogudafedinifavov.pdf
• http://www.ebsjosepirosamaria.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a85c001b90c---87301550627.pdf
• http://amwordpress.org/wp-content/plugins/formcraft/file-upload/server/content/files/1608f6dda8ac0e---87489859353.pdf
• http://comlark.ru/userfiles/files/3844447749.pdf
• http://amako-ra.com/wp-content/plugins/super-forms/uploads/php/files/0bc93f62ec33502cd7b759d8880863e8/47628181168.pdf
• https://www.cedicar.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ab838d3466d---37854787183.pdf
• http://ackerviewguesthouse.com/userfiles/file/jolaj.pdf
• http://www.canadavisaservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607961c235789---vajuzolugag.pdf
• http://thepnguyentran.com/media/ftp/file/nebitaberovalitinesinibo.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Embedded domains

• feedproxy.google.com
• soflocops.com
• www.alongsideasia.com
• bestbuyfromindia.com
• www.johnknox.ch
• arci-mp.fr
• bellevuecommunityfoodbank.org
• www.brennholz-heinlein.de
• www.ebsjosepirosamaria.com
• amwordpress.org
• comlark.ru
• amako-ra.com
• www.cedicar.com
• ackerviewguesthouse.com
• www.canadavisaservices.com
• thepnguyentran.com
• www.w3.org
• purl.org
• ns.adobe.com
• 1utilaje.ro
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 52.253.84.76
• 52.110.12.20
• 4.230.171.124
• 4.150.223.108
• 40.84.85.40
• 52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report