MALICIOUS — pinuvafijudogeragur.pdf
MALICIOUS — pinuvafijudogeragur.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100). 3 of 23 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
2e3adeafa415a2e462bc9a8edf768453044af89bd63cd3268e39dc29fe68f456 - SHA-1:
abfd554f82d3ecb3fd03a86bd99421dd7a8da57a - MD5:
b0bb9537927ff6684a9a424d1c62bd6a - ssdeep:
1536:1F6AYS5zvsLqKuH0CQF6vpgKC8t0Cz8LEJakvFqy+rWQpOCoWaSBi+5+krf:v604qKuHScvpv1z8LEjky+WCKSBi+YG - TLSH:
T10938D1F311E7DE4C738B9F07A9EE1168A046D7886165DFA0448CB6AC943C67DAF10B11 - Submitted as: pinuvafijudogeragur.pdf
- File type: pdf · Size: 78865 bytes
- Verdict: malicious (91/100)
Detections (3 of 23 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The malicious score of 91/100 is the fusion of 7 weighted signals:
- Dropped a malicious payload (Lazarus): root_.cache_dconf_user - dynamic signal, weight 0.80, confidence 0.90
- Contacted 23 external host(s) at runtime (3 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: http://tizianaiberti.it/userfiles/files/60114017156.pdf, https://gospel-streams.com/asset/ckfinder/userfiles/files/nesif.pdf, http://domuran.pl/files/file/kitunaxof.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
9678 behavior events · 1 ATT&CK techniques · 4 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- searchapp.bundleassets.example
- staging.to-do.officeppe.com
- inference.location.live.net
- desktop-hsgcbep
- 250.255.255.239.in-addr.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- ntp.ubuntu.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- 23.40.52.209
- 23.11.37.157
- 40.126.14.162
- 20.89.1.8 JP · Tokyo · AS8075 Microsoft Corporation
Dropped files
- /opt/CAPEv2/storage/analyses/25263/files/5cf4abbc0a4075f9be588652b9b892ea554f54d760299343ac70a8d512bd7461 -
5cf4abbc0a4075f9be588652b9b892ea554f54d760299343ac70a8d512bd7461 - /opt/CAPEv2/storage/analyses/25263/files/ce1d900ef91cc1a29f46f89bf1960934a1ef2e62f4e12f860afe0ee73f493632 -
ce1d900ef91cc1a29f46f89bf1960934a1ef2e62f4e12f860afe0ee73f493632 - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7 - tmp_tmp.SVeiCdueSm -
dfd0794d8da583517d4888454ae2d5f4d4722b91d6345b16477e8ac6ac3519fa
Embedded URLs
- https://feedproxy.google.com/~r/Uplcv/~3/1KS0DP0cxss/uplcv?utm_term=2003+mitsubishi+eclipse+gt+manual
- http://tizianaiberti.it/userfiles/files/60114017156.pdf
- https://gospel-streams.com/asset/ckfinder/userfiles/files/nesif.pdf
- http://domuran.pl/files/file/kitunaxof.pdf
- http://jonkmp.nl/img/cms/file/mixumogejimidokowukerov.pdf
- https://greenfuturevietnam.com/Upload/files/wivovowokutasabisa.pdf
- https://ngoctraithaibinhduong.com/uploads/news_file/22839890683.pdf
- http://kvbm.org/pds/userfiles/files/79090145686.pdf
- https://www.karenlovelee.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609f05bd9dcc9---91235736921.pdf
- https://www.chartsunlimited.com.ph/wp-content/plugins/formcraft/file-upload/server/content/files/160c0a625e7671---nolawanejaniwofumaka.pdf
- https://sitebyside.ru/wp-content/plugins/super-forms/uploads/php/files/1d3da002977ad59825e2ccafef1b5a00/degakonawajixe.pdf
- http://ibnuaffan.com/ckfinder/userfiles/files/82063946066.pdf
- https://comesa.com.pe/wp-content/plugins/super-forms/uploads/php/files/a2addb8cd55fbe48f6b7f179dc373de0/40803037449.pdf
- https://dazzlin.co.uk/wp-content/plugins/super-forms/uploads/php/files/907ca29440f0b5f366d9e7e7c85022b6/firekututanomutinuwe.pdf
- http://tugrabilgisayar.net/resimler/files/fodawawefewamesuzanowogor.pdf
- https://esprimagroup.com/userfiles/file/88920138802.pdf
- https://vishalahospitality.com/ckfinder/userfiles/files/vepegonadelamo.pdf
- http://xn--rssx31a7tec6p.com/upload/userfiles/files/20210722070943.pdf
- http://0-50.ru/userfiles/file/fogivokeguwet.pdf
- http://eyupsifalibitkiler.com/resimler/files/xiboxotigisunel.pdf
- https://edukiya.com/wp-content/plugins/super-forms/uploads/php/files/08803581c0938d06f2d8df5aceaf6493/75280164781.pdf
- http://www.socalgreatwhite.com/wp-content/plugins/formcraft/file-upload/server/content/files/160905d2547315---purosipexebil.pdf
- http://garmagostaran.com/Upload/file/tagunol.pdf
- https://nowackleverkusen.de/wp-content/plugins/formcraft/file-upload/server/content/files/1606c98ff65b2e---winigegegokanejopaduv.pdf
- http://petra-dario.info/upload/datoteke/26575600628.pdf
Embedded domains
- feedproxy.google.com
- tizianaiberti.it
- gospel-streams.com
- domuran.pl
- jonkmp.nl
- greenfuturevietnam.com
- ngoctraithaibinhduong.com
- kvbm.org
- www.karenlovelee.com
- sitebyside.ru
- ibnuaffan.com
- dazzlin.co.uk
- tugrabilgisayar.net
- esprimagroup.com
- vishalahospitality.com
- xn--rssx31a7tec6p.com
- 0-50.ru
- eyupsifalibitkiler.com
- edukiya.com
- www.socalgreatwhite.com
- garmagostaran.com
- nowackleverkusen.de
- petra-dario.info
- www.w3.org
- purl.org
Embedded IP addresses
- 4.247.188.233
- 74.178.240.61
- 20.89.1.8
- 4.150.223.101
- 135.234.160.247
- 72.145.35.108
- 4.144.132.114
- 162.159.36.2
- 203.26.79.13
- 4.230.171.124
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report