MALICIOUS — 3cc6afb4f4328b008e5de5df7e9aba0cfa5768c59a7bfe580b8cca9f1fe0b41a

MALICIOUS — 3cc6afb4f4328b008e5de5df7e9aba0cfa5768c59a7bfe580b8cca9f1fe0b41a is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 54 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 3cc6afb4f4328b008e5de5df7e9aba0cfa5768c59a7bfe580b8cca9f1fe0b41a
SHA-1: cf5c10d1acb3a6e58e66b6d85424455f6f02bdc4
MD5: 5a35b4402695df4c268b1aa8b36ddcde
ssdeep: 1536:oyrCShMcDKiCftG6dBLbGB+ztRYWtCJY/ALe+jWxApOGzWF+hlRDbAoGYM:VOcL2TM6r8+fYdM3GjhlRNE
TLSH: T16539D0F322E3EE4C37C78F8729D652ACA186D7886171E6904188657CC97C6BEBF00651
Submitted as: 3cc6afb4f4328b008e5de5df7e9aba0cfa5768c59a7bfe580b8cca9f1fe0b41a
File type: pdf · Size: 84908 bytes
Verdict: malicious (99/100)

Detections (4 of 54 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://delphin-bau.com/ckfinder/upload/files/tipifidur.pdf - network signal, weight 0.70, confidence 0.80
Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://medvor.ru/uplcv?utm_term=gry+wy%C5%9Bcigi+android+chomikuj, http://www.corazondelsol.es/ckfinder/userfiles/files/xikagoxe.pdf, http://kunbot.com/upload/files/vonov.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Contacted 6 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in Acrobat.exe (pid 3900) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

995 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
desktop-hsgcbep._dosvc._tcp.local
desktop-hsgcbep(1)._dosvc._tcp.local
desktop-hsgcbep(2)._dosvc._tcp.local
desktop-hsgcbep(3)._dosvc._tcp.local
desktop-hsgcbep(4)._dosvc._tcp.local
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
23.40.52.85
23.11.37.157
20.190.142.166
23.198.40.44
52.110.12.8 AU · Sydney · AS8075 Microsoft Corporation
4.230.171.124 KR · Seoul · AS8075 Microsoft Corporation
23.33.238.103

Dropped files

root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://medvor.ru/uplcv?utm_term=gry+wy%C5%9Bcigi+android+chomikuj
http://www.corazondelsol.es/ckfinder/userfiles/files/xikagoxe.pdf
http://kunbot.com/upload/files/vonov.pdf
https://delphin-bau.com/ckfinder/upload/files/tipifidur.pdf
https://dyaa.club/uploads/file/mabiwagefoziludataxif.pdf
http://baocaosuhoatoc.com/luutru/files/nobabinezasazonax.pdf
https://sunkamalzemecilik.com/userfiles/file/fekenarevemewuve.pdf
https://infravoip.com/wp-content/plugins/super-forms/uploads/php/files/58c2c5e5ffd57ae5a27e709e7b8f2293/kosen.pdf
http://albertopizzetti.it/userfiles/files/29440677224.pdf
http://gennarimaq.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1613a96089060d---zatasam.pdf
https://www.karavanlakesfet.com/wp-content/plugins/super-forms/uploads/php/files/f08662a37439598d32648aa436874dfa/26908986837.pdf
http://baanpowertrain.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612fc45ccc80f---92019398577.pdf
https://academiapreprod.riportico.com/userfiles/files/guzuxijimidezuwivotegumo.pdf
http://2017.letnifestiwal.pl/ckfinder/userfiles/files/xukeworojupej.pdf
http://bbhshipyard.com/userfiles/file/timatejidamaralutuzux.pdf
http://tsrmvolontari.it/userfiles/files/kojidusizo.pdf
http://mijinmotor.com/fckeditor/userfiles/file/pesirezenar.pdf
http://ppfi-online.com/userfiles/file/degoba.pdf
http://madmojo.com/fckupload/file/kawoladu.pdf
https://gbp.dropship-online.com/userfiles/files/vuxonetasoluwajenu.pdf
https://pachetedeturism.ro/images/files/dapubemipebepurireko.pdf
http://luberoff.com/userfiles/file/romekamaxoje.pdf
http://skolky.info/foto/images/file/xemijobudilenon.pdf
https://meritumptt.pl/dokumenty/file/dupak.pdf
https://zapret-rf.org/web/img/podborky/files/75157604122.pdf

Embedded domains

medvor.ru
www.corazondelsol.es
kunbot.com
delphin-bau.com
dyaa.club
baocaosuhoatoc.com
sunkamalzemecilik.com
infravoip.com
albertopizzetti.it
gennarimaq.com.br
www.karavanlakesfet.com
baanpowertrain.com
academiapreprod.riportico.com
2017.letnifestiwal.pl
bbhshipyard.com
tsrmvolontari.it
mijinmotor.com
ppfi-online.com
madmojo.com
gbp.dropship-online.com
luberoff.com
skolky.info
meritumptt.pl
zapret-rf.org
bud-med.eu

Embedded IP addresses

72.145.35.97
52.110.12.8
4.230.171.124
85.210.196.11
135.232.92.137
72.153.5.129

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report