MALICIOUS — 3cffc69c4d1b7cda729ea5b181c5f2f1a25bb07ccf97d316a7d0b53b1a8582f7
MALICIOUS — 3cffc69c4d1b7cda729ea5b181c5f2f1a25bb07ccf97d316a7d0b53b1a8582f7 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
3cffc69c4d1b7cda729ea5b181c5f2f1a25bb07ccf97d316a7d0b53b1a8582f7 - SHA-1:
3e22720cffe43dc1dd77ae61317940ab4b234cfa - MD5:
815ba8f65ef7fbbe6c2a30dd87e4c626 - ssdeep:
3072:DxNel0DkjTAQTSiewkWE9YUduIC18oOjI50Xh/YvmfUKKbuK:dNTD2ThTSILE+Udns1J2x0d - TLSH:
T13E4102F310DBDE4C76862F57B8EA145E6B85830931235F800899BA7C887C6FD3B51A61 - Submitted as: 3cffc69c4d1b7cda729ea5b181c5f2f1a25bb07ccf97d316a7d0b53b1a8582f7
- File type: pdf · Size: 182214 bytes
- Verdict: malicious (98/100)
Detections (4 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 7 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: https://uploads.strikinglycdn.com/files/0ec1e3c8-8b64-4ac5-9b32-3d241f5ebcea/53672060224.pdf - network signal, weight 0.70, confidence 0.80
- Contacted 15 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://xezojetit.ru/strik?utm_term=buy+tamil+magazines+in+usa, https://sinegozedajosor.weebly.com/uploads/1/3/1/8/131871849/nogisepasezodi_letop_xawejekepurome.pdf, https://uploads.strikinglycdn.com/files/0ec1e3c8-8b64-4ac5-9b32-3d241f5ebcea/53672060224.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Extracted generic config (8 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
9912 behavior events · 0 ATT&CK techniques · 3 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- desktop-hsgcbep
- ntp.ubuntu.com
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- _dosvc._tcp.local
- 250.255.255.239.in-addr.arpa
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
Dropped files
- C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\c4cef965c88a55a5e190e165d8759eb6.png -
b526c438cd8ab068f95f9f583c1f3c29c1e5a4ff1131c3afd03124cbe23faed4 - C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt -
2983e2039ab5feaf118ca5867346808fae222d0d9fc6a01986e699b7cd318d6f - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://xezojetit.ru/strik?utm_term=buy+tamil+magazines+in+usa
- https://s3.amazonaws.com/tiluwisulepam/what_is_literary_structuralism.pdf
- https://s3.amazonaws.com/najipavez/how_to_calculate_the_flow_rate.pdf
- https://sinegozedajosor.weebly.com/uploads/1/3/1/8/131871849/nogisepasezodi_letop_xawejekepurome.pdf
- https://s3.amazonaws.com/mukut/60313980289.pdf
- https://uploads.strikinglycdn.com/files/0ec1e3c8-8b64-4ac5-9b32-3d241f5ebcea/53672060224.pdf
- https://cdn-cms.f-static.net/uploads/4504641/normal_602565d40c782.pdf
- https://bigimenuxorotel.weebly.com/uploads/1/3/4/6/134655509/5fceb4.pdf
- https://besivopu.weebly.com/uploads/1/3/4/7/134705308/1998002.pdf
- https://cdn-cms.f-static.net/uploads/4424935/normal_5fd127fba153b.pdf
- https://uploads.strikinglycdn.com/files/a2e14d5c-0ed0-4cf6-b532-c852423ff108/42889062964.pdf
- https://static.s123-cdn-static.com/uploads/4377381/normal_5ff2e33e5246e.pdf
- https://uploads.strikinglycdn.com/files/ba67fb52-0bf2-4ef3-9186-ad1ef38200b2/how_can_i_talk_to_uscis_customer_service.pdf
- https://s3.amazonaws.com/sepawi/61884864565.pdf
- https://bizitaninajoki.weebly.com/uploads/1/3/5/3/135316521/4112379.pdf
- https://s3.amazonaws.com/wexukufedepim/latex_algorithmic_package.pdf
- https://jalewigevat.weebly.com/uploads/1/3/2/6/132681207/29bd3e090168b.pdf
- https://s3.amazonaws.com/posaxugidut/33030636178.pdf
- https://s3.amazonaws.com/lonozote/47839316232.pdf
- https://uploads.strikinglycdn.com/files/62f492d0-624c-450f-818b-d4389b6a4db6/how_to_use_excel_2013_for_students.pdf
- https://s3.amazonaws.com/navoburarovada/assignment_method_in_operation_research.pdf
- https://uploads.strikinglycdn.com/files/f69ced93-e508-4bbf-a205-f5827b88b093/how_to_become_a_certified_lash_technician_ontario.pdf
- https://static.s123-cdn-static.com/uploads/4474448/normal_5fc726de04a84.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- xezojetit.ru
- s3.amazonaws.com
- sinegozedajosor.weebly.com
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- bigimenuxorotel.weebly.com
- besivopu.weebly.com
- static.s123-cdn-static.com
- bizitaninajoki.weebly.com
- jalewigevat.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Embedded IP addresses
- 13.69.116.104
- 172.66.2.5
- 52.110.12.37
- 4.230.171.124
- 52.230.59.222
- 135.232.92.97
- 74.178.240.61
- 135.233.95.144
- 52.123.129.14
- 40.103.64.242
- 172.178.240.162
- 135.233.95.80
- 203.26.79.13
- 52.123.252.198
- 20.52.64.200
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report