MALICIOUS — 34a9e8662a05a5eeee849bfc5968cb2d0d235a199af8b7e8e577aa94b7b9aa66

MALICIOUS — 34a9e8662a05a5eeee849bfc5968cb2d0d235a199af8b7e8e577aa94b7b9aa66 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 34a9e8662a05a5eeee849bfc5968cb2d0d235a199af8b7e8e577aa94b7b9aa66
SHA-1: 4febdd5712cab7ce9d8af1411e0685b2c486650f
MD5: b08d93f02f127c67d3deaa63d021611e
ssdeep: 1536:0NJlXYHK4mTIAoHtSiJKtW+bOJb6PGWSU1gsKw07UaMmuxeEJ1L:NtDAoNS7E+Atxh7UaMnoED
TLSH: T11138E0F3009BEE4DFB469B032DA715356596D7C891329B204489B73C987C2ED3E20E60
Submitted as: 34a9e8662a05a5eeee849bfc5968cb2d0d235a199af8b7e8e577aa94b7b9aa66
File type: pdf · Size: 82652 bytes
Verdict: malicious (98/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!B08D93F02F12
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4371248/normal_5fec182dec012.pdf - network signal, weight 0.70, confidence 0.80
Contacted 22 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://dugedepap.ru/award?keyword=jeevan+shanti+850+pdf, http://pisonepegosa.myartsonline.com/dd_3.5_druid_handbook.pdf, https://petirinupupa.weebly.com/uploads/1/3/1/4/131438611/97ffced4a3341.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (13 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9750 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
desktop-hsgcbep._dosvc._tcp.local
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\d31c8d0a3970d08f98a1404c98598f8a.png - f35662bff83c36e560ed6bb2f9c0da54dd1aeac3260ce59b9aa1635d9d6f209f
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - c2d7971c62d4f114f36b10b055954d835fe4d5ea54bc5bc995a9dd1151f8fe61
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://dugedepap.ru/award?keyword=jeevan+shanti+850+pdf
http://pisonepegosa.myartsonline.com/dd_3.5_druid_handbook.pdf
https://petirinupupa.weebly.com/uploads/1/3/1/4/131438611/97ffced4a3341.pdf
http://luregaw.onlinewebshop.net/margites_homero.pdf
https://cdn-cms.f-static.net/uploads/4373997/normal_60279bb84481b.pdf
http://fodefon.getenjoyment.net/what_is_xanadu_in_kubla_khan.pdf
http://kufekisawisewo.onlinewebshop.net/wibokukekumalupepisoxap.pdf
https://juvuxoxeziw.weebly.com/uploads/1/3/4/3/134313380/bifatepon.pdf
http://dolinoko.atwebpages.com/5018886802.pdf
http://punexowimuseva.epizy.com/guxededojajebajuvajanuf.pdf
https://satewode.weebly.com/uploads/1/3/1/4/131407014/dagolom.pdf
https://voteriboxovoviv.weebly.com/uploads/1/3/4/3/134352377/mijirepobarixag.pdf
https://rusajilema.weebly.com/uploads/1/3/4/8/134853265/4cef4.pdf
https://pekafajifazudo.weebly.com/uploads/1/3/4/4/134478446/4940040.pdf
https://static.s123-cdn-static.com/uploads/4371248/normal_5fec182dec012.pdf
http://rixanemusijod.mywebcommunity.org/a_pragmatic_guide_to_business_process_modelling.pdf
http://sanikivatuma.rf.gd/blank_space_song.pdf
https://kewojuposadut.weebly.com/uploads/1/3/4/3/134374438/kulaliveduj.pdf
https://cdn-cms.f-static.net/uploads/4445864/normal_6019d3fc1bd2a.pdf
https://static.s123-cdn-static.com/uploads/4388285/normal_5fefe6bfdc2a4.pdf
https://static.s123-cdn-static.com/uploads/4390659/normal_5ffa755be0b27.pdf
http://jorowijedo.mywebcommunity.org/82145330353.pdf
http://lekirajadu.epizy.com/kilibetokuxudixo.pdf
http://mevukavotidu.getenjoyment.net/foroxiz.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

dugedepap.ru
pisonepegosa.myartsonline.com
petirinupupa.weebly.com
luregaw.onlinewebshop.net
cdn-cms.f-static.net
fodefon.getenjoyment.net
kufekisawisewo.onlinewebshop.net
juvuxoxeziw.weebly.com
dolinoko.atwebpages.com
punexowimuseva.epizy.com
satewode.weebly.com
voteriboxovoviv.weebly.com
rusajilema.weebly.com
pekafajifazudo.weebly.com
static.s123-cdn-static.com
rixanemusijod.mywebcommunity.org
kewojuposadut.weebly.com
jorowijedo.mywebcommunity.org
lekirajadu.epizy.com
mevukavotidu.getenjoyment.net
www.w3.org
purl.org
ns.adobe.com
sanikivatuma.rf.gd

Embedded IP addresses

74.178.232.29
85.210.193.152
172.215.188.225
13.89.179.15
20.89.1.11
40.84.85.40
52.110.12.47
52.230.60.54
4.230.171.124
74.178.240.61
52.168.117.171
20.165.94.63
40.99.133.226
52.123.128.14
172.178.240.161
72.153.5.62
203.26.79.13
20.184.175.10
57.155.104.224
48.192.143.121
52.168.117.174
20.42.65.94

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report