MALICIOUS — vexisufim.pdf

MALICIOUS — vexisufim.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 37b77cdd623635debd7fabf1d0b698678b3737db63a350f40bd63cdff98ab111
SHA-1: 45fa9b95568cca2bdb4d75c0d0dc6e6ce989621e
MD5: 07e5e0676a155b4b7480b2e05e490be3
ssdeep: 1536:mAVSA+zAYJ4tRQ+fQUEevvgFGPd5nbMcpUq4oxAG9LzclDXy3XFfuZga:rSA+zAYc++f1Xge/nI+OcclaFfuz
TLSH: T1BE38D1F3118BDD9C7ACB9713ABE7159860DEC3842231D7680468B6ADC4BCA7C7A14A50
Submitted as: vexisufim.pdf
File type: pdf · Size: 82437 bytes
Verdict: malicious (96/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!07E5E0676A15
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 10 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://bursaceviritercume.com/wp-content/plugins/formcraft/file-upload/server/content/files/16070568f5d13d---wavekemaneromejoxalawigob.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: http://104.156.58.56/~web2inbox/wp-content/plugins/formcraft/file-upload/server/content/files/1608615fc623db---59803149125.pdf, http://www.ncstarim.com.tr/wp-content/plugins/super-forms/uploads/php/files/jo5gcsnlid58cujhhnmds4gfu4/tukisop.pdf, http://sazjah.com/wp-content/plugins/formcraft/file-upload/server/content/files/160920811b7fbc---sojitilapaxikaxe.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (17 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9702 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787774651&P2=404&P3=2&P4=J4NUZwIowh4sKzUSbLdCIdNOJOUvZifdnb%2fQHkBgg4wsgOnrFv1sC1uULMidIxDJEXtCxFtamjvaE3vdEBz2Rg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787774733&P2=404&P3=2&P4=fXsTPNjTuh7bn91akaFZHTI7MGuQB4htnBnPJc5OX%2boDad1MsrtnCyuoCtlpnQEsdzN13tK657HKqGoQQBaaag%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
192.168.122.110
23.40.52.209

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\a4d3a6ca23e75fad41ade171a7f8e5fd.png - 7c82ef33c05442a94a8d8e238f837a361f10734e5ca8e468e101f9403816da51
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - da78a2f2c6e0b0c987c8792614f5ac80f38b3c2a1cd6c28e8e403729499e1832
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/skout/mBVl/~3/ngfLrbzwjls/uplcv?utm_term=icivics+federal+in+federalism+answers
http://104.156.58.56/~web2inbox/wp-content/plugins/formcraft/file-upload/server/content/files/1608615fc623db---59803149125.pdf
http://www.ncstarim.com.tr/wp-content/plugins/super-forms/uploads/php/files/jo5gcsnlid58cujhhnmds4gfu4/tukisop.pdf
http://sazjah.com/wp-content/plugins/formcraft/file-upload/server/content/files/160920811b7fbc---sojitilapaxikaxe.pdf
http://fashioncenterpoint.com/wp-content/plugins/super-forms/uploads/php/files/41e8002c38cf449fe805d904295e354b/rutugagunebaf.pdf
https://www.indee-r.fr/wp-content/plugins/super-forms/uploads/php/files/2bfeedd82e06205c912b83627cc00344/wajupidivijunibetijaxipi.pdf
http://www.fotografoeventimilano.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075a1716ff0f---27855210448.pdf
http://sts-logistika.ru/wp-content/plugins/super-forms/uploads/php/files/341dff4474a4315b13f721f62f4daba8/48483759833.pdf
https://bursaceviritercume.com/wp-content/plugins/formcraft/file-upload/server/content/files/16070568f5d13d---wavekemaneromejoxalawigob.pdf
https://www.ediliziaindustriale.com/wp-content/plugins/formcraft/file-upload/server/content/files/16081576f943de---solajebuxosikevila.pdf
https://teenvolunteerhouston.com/wp-content/plugins/super-forms/uploads/php/files/95da0c57d1bf9aaa158e61df43ca66bb/jafirewofumitipoloj.pdf
https://gdr.co.il/wp-content/plugins/super-forms/uploads/php/files/75ca4fd35f2c0608747dfab6159b9d69/96472020489.pdf
http://www.cheapmotorcycleinsurancepa.com/wp-content/plugins/super-forms/uploads/php/files/glftnss51a3fumioioahin8525/83483163435.pdf
http://www.belladermeestetica.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1607d51a3dc7e4---36859085882.pdf
https://jjmassociates.com/wp-content/plugins/super-forms/uploads/php/files/037097d30f0032b296fed44e67b0d8da/42994637323.pdf
http://www.zulfugar.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16090b80371609---27112708817.pdf
http://www.aluvascientific.com/UserFiles/file/84850133432.pdf
https://inchirierielicopter.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160933eb3990c8---40700869959.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt

Embedded domains

feedproxy.google.com
sazjah.com
fashioncenterpoint.com
www.indee-r.fr
www.fotografoeventimilano.com
sts-logistika.ru
bursaceviritercume.com
www.ediliziaindustriale.com
teenvolunteerhouston.com
www.cheapmotorcycleinsurancepa.com
www.belladermeestetica.com.br
jjmassociates.com
www.zulfugar.nl
www.aluvascientific.com
www.w3.org
purl.org
ns.adobe.com
www.ncstarim.com.tr
gdr.co.il
inchirierielicopter.ro

Embedded IP addresses

104.156.58.56
52.110.12.56
52.110.12.2
4.230.171.124
20.42.179.204
20.247.184.142
20.165.94.63
72.153.5.62
203.26.79.13
20.42.65.85
52.123.128.14

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report