MALICIOUS — 3c2a8fbc3629125e0cb72832695d9ef9e2627f53b03daf7a0fa209ec9fa0e963

MALICIOUS — 3c2a8fbc3629125e0cb72832695d9ef9e2627f53b03daf7a0fa209ec9fa0e963 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 3c2a8fbc3629125e0cb72832695d9ef9e2627f53b03daf7a0fa209ec9fa0e963
SHA-1: c8ec31500ae613bdabf3250b806e6e61b920b556
MD5: 6c0160cc98dd4e877507c55738dd285b
ssdeep: 1536:XrAIlHQIzA4X2mdNU5fJbn8zjaAiA1lVWSgJ0eSWapOtQY4enpy+B:7Blhzd2vfJL8zjaAnYNvtQY4ApH
TLSH: T11F37C0F3209BDE4CB68ADF036AB71558B10AD78C61B1DAA040487A7DD47C9BE3F04A50
Submitted as: 3c2a8fbc3629125e0cb72832695d9ef9e2627f53b03daf7a0fa209ec9fa0e963
File type: pdf · Size: 73405 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://perilatomsk.ru/ckfinder/userfiles/files/27988656118.pdf - network signal, weight 0.70, confidence 0.80
Contacted 17 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://pistant.ru/uplcv?utm_term=the+soviet+chess+primer+ebook, http://nek.ua/wp-content/plugins/formcraft/file-upload/server/content/files/16138325682ce0---43810392160.pdf, http://perilatomsk.ru/ckfinder/userfiles/files/27988656118.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9634 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 602c89416557c687be509d0c5eb5c8aa4e7392270091f3b560d7dfa5940ecf06
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\e799deddce050ffe501889abc95014d3.png - 548f13fbf28b4fe13e201b7d93bf890fedab0cf35dfb7cb5268861b4cde96e70
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://pistant.ru/uplcv?utm_term=the+soviet+chess+primer+ebook
http://nek.ua/wp-content/plugins/formcraft/file-upload/server/content/files/16138325682ce0---43810392160.pdf
http://perilatomsk.ru/ckfinder/userfiles/files/27988656118.pdf
http://hycxchina.com/filespath/files/20210915165817.pdf
https://wyslijpaczki.pl/app/webroot/files/userfiles/file/firokutewexidorakekurufi.pdf
https://eravukappalpalli.com/userfiles/file/janipuxoxogufunojiferum.pdf
https://christianklein.eu/Quansis/ckfinder/userfiles/files/67210604826.pdf
https://www.ijestr.com/ckfinder/userfiles/files/73689591441.pdf
https://whatshoulditcostme.com/userfiles/file/2220142212.pdf
https://cordovajewelry.com/images/file/bovekile.pdf
https://ppkh.net/userfiles/file/68872607717.pdf
https://www.fecomerciomg.org.br/wp-content/plugins/formcraft/file-upload/server/content/files/1613c3bbe1d400---28565899548.pdf
http://grupafurman.pl/!mag2011/userfiles/file/rubobavazoded.pdf
https://sysyanginguvenlik.com/uploads/files/ribaduwepasuvujado.pdf
https://www.cir.cloud/wp-content/plugins/formcraft/file-upload/server/content/files/161403edd773ef---87448241389.pdf
https://manhremhoangvan.com/wp-content/uploads/files/30063642537.pdf
http://groupkaishan.com/d/files/bowelipe.pdf
https://autopits-directo.migrupoq.com/ckfinder/userfiles/files/dedozepilosexefoxoxenenu.pdf
http://scandinavia-ex.com/images/blog/file/41617889511.pdf
http://soc-in.com/data/media/files/fubazujojo.pdf
https://organicfertilizerproduction.com/d/files/rulijifesan.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/

Embedded domains

pistant.ru
nek.ua
perilatomsk.ru
hycxchina.com
wyslijpaczki.pl
eravukappalpalli.com
christianklein.eu
www.ijestr.com
whatshoulditcostme.com
cordovajewelry.com
ppkh.net
www.fecomerciomg.org.br
grupafurman.pl
sysyanginguvenlik.com
www.cir.cloud
manhremhoangvan.com
groupkaishan.com
autopits-directo.migrupoq.com
scandinavia-ex.com
soc-in.com
organicfertilizerproduction.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

135.233.95.144
172.66.2.5
48.211.4.16
4.230.171.124
85.210.193.152
52.230.60.54
72.154.7.112
203.26.79.13
135.233.95.135
74.178.76.128
52.123.129.14
40.103.64.226
172.178.240.161
135.232.92.34
92.223.78.30
48.192.143.121
20.42.65.84

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report