MALICIOUS — 2f1620f549b30b1aa99f245579df0607e76cf58737e49e717c516ed14b6da8ab

MALICIOUS — 2f1620f549b30b1aa99f245579df0607e76cf58737e49e717c516ed14b6da8ab is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 2f1620f549b30b1aa99f245579df0607e76cf58737e49e717c516ed14b6da8ab
SHA-1: 96c2b6f273380c9b1ef1ec850acfac213b7eb3d5
MD5: 6ecb06d246353f8816933991b8bc0059
ssdeep: 1536:Sv+G9xeg1nXeC9UogpIsgWAuHY64WI2ahVUk6f3T8HWQpOCrm:Lfg1X59UoKIsgWAuH7orP6f3T8yCa
TLSH: T1DF38C0F7309BDDCDB7498B036AFA016CB09AD1841226AB6101CC7A7D81BC5BDFE14A51
Submitted as: 2f1620f549b30b1aa99f245579df0607e76cf58737e49e717c516ed14b6da8ab
File type: pdf · Size: 80828 bytes
Verdict: malicious (95/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 95/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 15 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://huntic.ru/uplcv?utm_term=fifa+20+apk+data+obb, http://tvcsoltau.de/userfiles/file/nodimirepatepotowutoma.pdf, http://studiotecnicobonoli.com/userfiles/files/17866614555.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9646 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787877072&P2=404&P3=2&P4=DAwF5CpsJ7oD2hbNV3gr20l4m30WtkRpbde%2bTjmFlR6reDxabr0ILFQm1%2bk7%2blg0i3c92ISW5Svg3sY2cdL8qg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 1a090836ffbaa4c2b06a9c68343bd04b8918b5ed1256688348556b804d463c2e
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\95fbaaebbca077647531c40cffc0b3d5.png - b6597f2960847b0e551e659248c36627a9eb2f244a3ad86bcafea8316a0a9b77
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://huntic.ru/uplcv?utm_term=fifa+20+apk+data+obb
http://tvcsoltau.de/userfiles/file/nodimirepatepotowutoma.pdf
http://studiotecnicobonoli.com/userfiles/files/17866614555.pdf
https://spcinternational.in/ckfinder/userfiles/files/49814806145.pdf
http://preprod.app-nomads.com/ugecam/admin/ckfinder/userfiles/files/63789267466.pdf
https://valubil.com/public/uploads/cms_file/cms_files/13837377958.pdf
http://www.olympussverige.se/wp-content/plugins/super-forms/uploads/php/files/n7el14r0jajdillmb2mo1s8d01/82366969881.pdf
https://elegune.net/files/galeria/files/79988646966.pdf
https://concertwristband.com/resimler/files/38537543532.pdf
https://augsburger-dartliga.de/uploads/file/28564084345.pdf
https://marlschuz.com/userfiles/files/87949549681.pdf
http://alles-vom-schreiner.de/userfiles/file/31805087567.pdf
http://karinameal.com/imgdish/files/memebosamizu.pdf
http://ranjitabiswas.com/userfiles/files/21974789383.pdf
https://mi-stores.com/basketballtotaal/images/editor/file/29546350860.pdf
http://chuabenhxuongkhop24h.com/images/files/xizuwaruguxamebapo.pdf
http://doo-san.com/userfiles/file/20210908102746.pdf
http://tageedesign.com/ssmpt/documents/file/kizijeg.pdf
https://przyklejki.pl/userfiles/xojowulegor.pdf
http://colleges-in-tamilnadu.com/FCKeditor/userfiles/file/wawaxikima.pdf
http://denis-lefebvre-services.com/fichiers/file/21768817223.pdf
http://www.hkrns.org.hk/ckfinder/userfiles/files/16765263331.pdf
http://akcco.com/userData/board/file/vunaravijovinufitig.pdf
http://yongqingtech.com/d/files/wixetozekerefijiredo.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

huntic.ru
tvcsoltau.de
studiotecnicobonoli.com
spcinternational.in
preprod.app-nomads.com
valubil.com
www.olympussverige.se
elegune.net
concertwristband.com
augsburger-dartliga.de
marlschuz.com
alles-vom-schreiner.de
karinameal.com
ranjitabiswas.com
mi-stores.com
chuabenhxuongkhop24h.com
doo-san.com
tageedesign.com
przyklejki.pl
colleges-in-tamilnadu.com
denis-lefebvre-services.com
www.hkrns.org.hk
akcco.com
yongqingtech.com
www.w3.org

Embedded IP addresses

4.150.223.102
52.110.12.21
52.110.12.47
57.155.101.212
4.230.171.124
20.247.184.197
74.178.240.51
40.99.134.2
74.178.240.61
52.123.128.14
135.234.160.246
203.26.79.13
20.42.72.131
92.223.78.30
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report