MALICIOUS — 3c9e8d14f399d94c7750bcdc4c1261128c7c8f1101fc911dc7a900eaae361a1d
MALICIOUS — 3c9e8d14f399d94c7750bcdc4c1261128c7c8f1101fc911dc7a900eaae361a1d is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100). 3 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
3c9e8d14f399d94c7750bcdc4c1261128c7c8f1101fc911dc7a900eaae361a1d - SHA-1:
7a0b38a2aed3c9bfd5c43fc1f1eca0be439da3fb - MD5:
ba5c07bd0c6dff48e6e209dcbc0da9fb - ssdeep:
1536:4GV5rChqbPM+AyWdojE80Yu1F2ee1Cb59:4GHmhqQryWdg3YF2BU59 - TLSH:
T186355CF311E7DE1C7A9E8F439DBB26AD6089D38962239B41448C372D917C6AEBF10411 - Submitted as: 3c9e8d14f399d94c7750bcdc4c1261128c7c8f1101fc911dc7a900eaae361a1d
- File type: pdf · Size: 58315 bytes
- Verdict: malicious (89/100)
Detections (3 of 54 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: Phish:PDF/FakeTool.P!MTB
- Emsisoft (Emergency Kit): PDF.Spam.Heur.4
MITRE ATT&CK
Why this verdict
The malicious score of 89/100 is the fusion of 8 weighted signals:
- Microsoft Defender flagged Phish:PDF/FakeTool.P!MTB (rule
Phish:PDF/FakeTool.P!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.4 (rule
PDF.Spam.Heur.4) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://gaminggenerator.org/app/431946152/roblox-magnet-simulator-hack, http://www.agri-tech.com.au/images/free-robux-on-roblox-youtube.pdf, http://brusivojimi.com/images/bloxrp-money-hack-roblox.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Contacted 14 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
1061 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- desktop-hsgcbep._dosvc._tcp.local
- desktop-hsgcbep(1)._dosvc._tcp.local
- desktop-hsgcbep(2)._dosvc._tcp.local
- desktop-hsgcbep(3)._dosvc._tcp.local
- desktop-hsgcbep(4)._dosvc._tcp.local
- desktop-hsgcbep(5)._dosvc._tcp.local
- _dosvc._tcp.local
- ntp.ubuntu.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- 23.40.52.85
- 23.11.37.157
- 20.190.167.150
- 52.230.60.54 SG · Singapore · AS8075 Microsoft Corporation
- 52.123.252.240 AU · Sydney · AS8075 Microsoft Corporation
Dropped files
- root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- http://gaminggenerator.org/app/431946152/roblox-magnet-simulator-hack
- http://www.agri-tech.com.au/images/free-robux-on-roblox-youtube.pdf
- http://brusivojimi.com/images/bloxrp-money-hack-roblox.pdf
- https://www.cnte.org.br/images/hot-to-get-robux-for-free.pdf
- http://eleveurs-autrement.fr/images/roblox-admin-hack-apk.pdf
- http://www.mikramarine.gr/images/roblox-jouer-avec-un-mec-qui-hack.pdf
- https://www.gymun.cz/images/how-to-get-free-robux-gift-cards-2021.pdf
- https://socialvalue.gr/images/free-robux-no-verification-2021-android.pdf
- http://rose-mari.com.ua/images/how-i-get-free-robux-rbxrewards.pdf
- http://nevesomost.by/images/how-do-you-get-unlimited-robux-for-free.pdf
- http://mechanism.gr/images/how-to-get-free-robux-in-ios-ipad.pdf
- https://studentcareerinfo.com/images/free-roblox-accounts-november-2021.pdf
- http://cleananddecluttered.com/images/roblox-free-adidas-teu.pdf
- http://ferienhaus-schmidl.at/images/roblox-hack-robux-games.pdf
- http://apd-ukraine.de/images/free-robuxtoday-2.pdf
- http://baah.ca/images/free-robux-xbox-one.pdf
- https://www.romedia.gr/images/how-to-hack-roblox-on-ios.pdf
- https://www.udivadlahotel.cz/images/roblox-redeem-card-hack-2021.pdf
- http://www.brtes.com/images/free-roblox-admin-accounts.pdf
- https://hbln.org.au/images/games-like-bloxbutg-in-roblox-for-free.pdf
- http://swibome.nl/images/roblox-free-pin-generattor-no-survey.pdf
- https://www.wildpark-johannismuehle.de/images/roblox-on-ps4-free.pdf
- https://verdensbarn.no/images/free-roblox-app-for-ipad.pdf
- http://stackideas.com/images/free-roblox-gift-card-codes-2021.pdf
- https://www.seeingindependence.org/images/roblox-cheat-redline-working-mega.pdf
Embedded domains
- gaminggenerator.org
- www.agri-tech.com.au
- brusivojimi.com
- www.cnte.org.br
- eleveurs-autrement.fr
- rose-mari.com.ua
- studentcareerinfo.com
- cleananddecluttered.com
- apd-ukraine.de
- baah.ca
- www.brtes.com
- hbln.org.au
- swibome.nl
- www.wildpark-johannismuehle.de
- verdensbarn.no
- stackideas.com
- www.seeingindependence.org
- www.comitatoiseo.org
- jdlgroup.ca
- bdhcpa.com
- reggieslockandkey.com
- cleanteclogistics.com
- techmobil.pl
- greenoase.be
- pourvosvacances.com
Embedded IP addresses
- 172.172.255.217
- 203.26.79.13
- 172.172.255.218
- 52.230.60.54
- 52.123.252.240
- 52.110.12.25
- 4.230.171.124
- 20.184.175.2
- 74.178.240.61
- 20.42.179.192
- 20.42.73.25
- 72.145.35.107
- 172.215.188.232
- 52.148.114.188
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report