MALICIOUS — 160d30fd43ae6b---62320257813.pdf

MALICIOUS — 160d30fd43ae6b---62320257813.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 294950b75730f6a0fa49149a3c26f9ad71bbc04e02c0c30bdf5dec544ae8f936
SHA-1: e5061e771a26b9b58d299fddac7b5e170263fcee
MD5: e20cf2d0c94f53f138e9fa154b0d28bd
ssdeep: 1536:abj182YLK6txFeQzQYE+xul0tTLxRkS58biqH+/6wBhe3hTFQhR4QGddM7lVDWrK:wJ82Y26t7x43UTLHrzSwyu2QOdM7r2gr
TLSH: T18939DFF3914BDD9C3A87AB5365A604687047E7C872329BA45088B7ACC97C3FD6F20950
Submitted as: 160d30fd43ae6b---62320257813.pdf
File type: pdf · Size: 91965 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 20 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://www.medical-psychology.gr/wp-content/plugins/formcraft/file-upload/server/content/files/160a5f597bd932---pabeguguxi.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: http://chinalabware.ru/d/files/87369395483.pdf, http://nnk.gr/wp-content/plugins/formcraft/file-upload/server/content/files/1606d8a38a4baa---zarubuled.pdf, https://inchirierielicopter.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1609afa5bd1601---95119132810.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9697 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787780899&P2=404&P3=2&P4=aaUf0WgDNJlyW%2f2lT4mAmBA56ypfU3%2b3d8ASIp4o1oy%2bzUJw6UOM49wEsL0J0RCETV18t0j0DM8wueT2aVboSw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787780952&P2=404&P3=2&P4=KukkmsGoEypT8nwg3%2bnWUF2CoAvorllHzWAy7fONOMH%2btOMmwG1x68OVIsw3pkRT6sIu6Has6EJJHBldPqWpVw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787177651&P2=404&P3=2&P4=dlCJINuiM6YJrYF4JEGahyhOpj6kWY6QRXuJJH1TgKvyMuSplyngVh%2bjg42Q7bjeL2M8btagfSYlzY%2b5DwhnYA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\ff2921a3ae2ebaa74918fa25af857b78.png - 5c2c4bb1a885b5425f2aa07a3f0ba5c1d26d8ac5ef889b90d9f337e3e9a39c7e
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - b3d45bd9df664494eb8682aeb040a15b9786f719b58527911cce9b43e34aa0a6
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/skout/mBVl/~3/1KS0DP0cxss/uplcv?utm_term=enna+sona+instrumental+song+mp3+download
http://chinalabware.ru/d/files/87369395483.pdf
http://nnk.gr/wp-content/plugins/formcraft/file-upload/server/content/files/1606d8a38a4baa---zarubuled.pdf
https://inchirierielicopter.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1609afa5bd1601---95119132810.pdf
http://for-rent-aalst.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607614590f8a7---47291128533.pdf
http://www.medical-psychology.gr/wp-content/plugins/formcraft/file-upload/server/content/files/160a5f597bd932---pabeguguxi.pdf
http://beckydavidsonhomes.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609e14bfb827a---xarelozew.pdf
https://goldenparadisestsimons.com/wp-content/plugins/super-forms/uploads/php/files/c0531a8a4be3047552079084ce393d04/mosoxofifesezejukujoziz.pdf
http://aven.su/userfiles/file/guxadodesokugojazisuk.pdf
http://dabien.co.kr/wp-content/plugins/formcraft/file-upload/server/content/files/16086f911496db---rozasagaluvunuluvuxakigu.pdf
http://scvumaichiramen.com/uploads/files/muvesepipokodumogomopase.pdf
http://doks-films.com/pcms/content/file/52942047045.pdf
https://ecomassage.pt/wp-content/plugins/super-forms/uploads/php/files/r1vgj4vjq2r4k5e3okpmvp8i51/14630805645.pdf
https://bikinibody.be/wp-content/plugins/super-forms/uploads/php/files/ufh3dms0i1r4nsm8tsn5d7r7m9/34578588888.pdf
http://amtusa.com/wp-content/plugins/formcraft/file-upload/server/content/files/160703e6bdba90---bowifowaketafubafoka.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

feedproxy.google.com
chinalabware.ru
for-rent-aalst.com
beckydavidsonhomes.com
goldenparadisestsimons.com
aven.su
dabien.co.kr
scvumaichiramen.com
doks-films.com
bikinibody.be
amtusa.com
www.w3.org
purl.org
ns.adobe.com
nnk.gr
inchirierielicopter.ro
www.medical-psychology.gr
ecomassage.pt

Embedded IP addresses

57.154.63.210
4.230.171.124
4.144.132.114
74.179.77.204
20.165.94.54
52.123.129.14
40.99.133.210
40.99.134.2
52.123.252.225
72.153.5.130
203.26.79.13
135.232.92.137
52.123.252.197
135.232.92.34
92.223.78.30
4.247.188.224
52.182.143.212
4.150.223.100
52.148.114.188
142.251.42.99

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report