MALICIOUS — 2f638574c3fc46c5c91c29cc5cc0b938f8806e93bd5433b7edbb220135a6d598

MALICIOUS — 2f638574c3fc46c5c91c29cc5cc0b938f8806e93bd5433b7edbb220135a6d598 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 2f638574c3fc46c5c91c29cc5cc0b938f8806e93bd5433b7edbb220135a6d598
SHA-1: e0e273270eefc57b5ac050563d7e24b72a0931ad
MD5: 69e77faf6d71a27f4ecf60c6b66927dc
ssdeep: 1536:Xy7card9tCtpEQEaVNKxAnnlT0MHAxj5jpfNW5Al9iH1OWQpOC21i:ecard9tCoQZblTRo1jpf9lG1BC3
TLSH: T16438D1F320D7DD8CB79ADF03AABA16AD5085E7486172D5A04088777CD07C97DAF04A11
Submitted as: 2f638574c3fc46c5c91c29cc5cc0b938f8806e93bd5433b7edbb220135a6d598
File type: pdf · Size: 76674 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 15 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://jamoncup.es/wp-content/plugins/formcraft/file-upload/server/content/files/161343121841c3---zelofibabaga.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: http://bud-med.eu/userfiles/file/ritumumukovukopalumo.pdf, http://vdgairconditioning.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16133492351abf---tisijulolasudodazomuwago.pdf, http://studiopol.com/userfiles/files/33670936139.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9743 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
ntp.ubuntu.com
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\83a22f15f7c3eb52b51dc6705c269645.png - b5ca8dafdea40fbbecaa7783715a95716e70b3ef209a6e5a60d528424bac4acc
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - e72b2587b84c31def0a61c3be3236b2a04769efe2b4d9a219ca874db041e57fd
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/6naE_Nh8_CY/uplcv?utm_term=how+many+countries+in+the+world+pdf
http://bud-med.eu/userfiles/file/ritumumukovukopalumo.pdf
http://vdgairconditioning.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16133492351abf---tisijulolasudodazomuwago.pdf
http://studiopol.com/userfiles/files/33670936139.pdf
http://jamoncup.es/wp-content/plugins/formcraft/file-upload/server/content/files/161343121841c3---zelofibabaga.pdf
http://enidental.com/userfiles/file/20210915204520.pdf
https://media-get.com/userfiles/files/nepomev.pdf
http://vincityhomes.vn/wp-content/plugins/super-forms/uploads/php/files/f8tn35upf4kprcms93cb35pjug/puvigowus.pdf
http://etnorom.hu/pictures/76028511694.pdf
http://saigonford3s.com/uploads/2021-09-13/images/files/62836633563.pdf
https://amezdigital.com/wp-content/plugins/super-forms/uploads/php/files/37fd346fd0d2757bd1a618b3eee8364e/sadotabuxibiwokemopev.pdf
http://euromarkcreations.com/new/fck_img/file/nifowo.pdf
https://kozhikodedeaf.org/admin/my_files/file/4785657759.pdf
https://www.gs-gleichmann.de/wp-content/plugins/formcraft/file-upload/server/content/files/1614f63e9bb613---13081510433.pdf
https://floridainvestment.cz/files/file/movejegaboloxomiz.pdf
http://bafiti.com/sklep/userfiles/file/39531502554.pdf
http://le-lemniscus-incandescent.fr/ckeditor/upload/files/33165847238.pdf
http://gaia-onlus.org/userfiles/file/narixodorojosaduxok.pdf
http://studioego.cz/userfiles/file/55686690201.pdf
http://namlinhchisapa.com/userfiles/image/file/pixevibikudekaliza.pdf
https://www.euroservicemilano.it/wp-content/plugins/formcraft/file-upload/server/content/files/161377be302971---97555139273.pdf
http://musicandyouapp.com/webupload/editorimg/files/bevodawuwejofosi.pdf
http://nprofit.hk/userfiles/40295857015.pdf
http://madmojo.com/fckupload/file/47045976371.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

feedproxy.google.com
bud-med.eu
vdgairconditioning.nl
studiopol.com
jamoncup.es
enidental.com
media-get.com
saigonford3s.com
amezdigital.com
euromarkcreations.com
kozhikodedeaf.org
www.gs-gleichmann.de
bafiti.com
le-lemniscus-incandescent.fr
gaia-onlus.org
namlinhchisapa.com
www.euroservicemilano.it
musicandyouapp.com
nprofit.hk
madmojo.com
www.w3.org
purl.org
ns.adobe.com
vincityhomes.vn
etnorom.hu

Embedded IP addresses

172.172.255.218
172.66.2.5
4.230.171.124
135.232.92.97
20.76.201.171
135.233.95.144
40.99.134.18
135.234.160.245
52.123.252.224
72.145.35.111
203.26.79.13
135.234.160.246
172.170.180.133
52.182.143.212
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report