MALICIOUS — 3dfb1731a5ba1671f15d5411a89adce92217732d680822f968b3a3c0b2f30408

MALICIOUS — 3dfb1731a5ba1671f15d5411a89adce92217732d680822f968b3a3c0b2f30408 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 3dfb1731a5ba1671f15d5411a89adce92217732d680822f968b3a3c0b2f30408
SHA-1: ee0a50493f6d08578e8a59c0a41a292ab3f46ea4
MD5: b4d55c147d38f87264fd52bb47d39438
ssdeep: 1536:4QONbGsdTwXNO5/YhgpkO/PgpXAWQwK7HU4VgWnzdWApO6MHC:ENbGsyCjaMPgh4R04VbU6b
TLSH: T1C338C0F3219BDD5C378B9F0356EB51A8A0CBE3882462DBD0448C777C807C67DAA10952
Submitted as: 3dfb1731a5ba1671f15d5411a89adce92217732d680822f968b3a3c0b2f30408
File type: pdf · Size: 81306 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://www.asap-recruitment.net/upload/file/maxodokixi.pdf - network signal, weight 0.70, confidence 0.80
Contacted 20 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://ketchas.ru/uplcv?utm_term=ios+vs+android+compare+and+contrast, http://www.asap-recruitment.net/upload/file/maxodokixi.pdf, https://studioconcept-stand.com/fck_userfiles/file/bixeganatisamer.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9660 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
desktop-hsgcbep._dosvc._tcp.local
ntp.ubuntu.com
desktop-hsgcbep
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\cc96538d2737d6dcfad2153ace0ba1ad.png - 3bc68a40a940f88f673627ec64c55f29db148acc4e4e869941a121b6c35b094f
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - b58bcc3452f677e9c4bf9356b8803ae82f775ed6e87a505fffd4ee09bfa57f4e
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://ketchas.ru/uplcv?utm_term=ios+vs+android+compare+and+contrast
http://www.asap-recruitment.net/upload/file/maxodokixi.pdf
https://studioconcept-stand.com/fck_userfiles/file/bixeganatisamer.pdf
https://editora-arara-azul.com.br/site/admin/ckfinder/userfiles/files/19685110166.pdf
http://lafenicealcamo.it/userfiles/files/jukaxoxevilitugizokefixe.pdf
http://altaprecision.com/userfiles/file/48261475221.pdf
http://xinshifm.com/userfiles/file/dimepele.pdf
http://deleersnijder-bocaege.be/images/file/kadegonevajobokipevonogu.pdf
https://finestblogger.de/wp-content/plugins/super-forms/uploads/php/files/8m155rji4d7hiv0adm1d66jsvl/suwaxujudupetinupifani.pdf
https://thepainter.asia/upload/files/riraxat.pdf
http://easyhypermarket.com/userfiles/file/xenafopanujekop.pdf
http://dangkyidol.com/wp-content/plugins/super-forms/uploads/php/files/unrjh7is5dp8bl9gpnbq72t80c/mirubisejasefur.pdf
https://asigurareingermania.ro/wp-content/plugins/super-forms/uploads/php/files/hombhr3ucfq9scupch1ab118pe/3608395118.pdf
http://portalcom-b2b.es/img/user//file/_0958086001631172757.pdf
https://daquin-ferriere.fr/userfiles/file/bevawuxegaxufuxasoj.pdf
https://uroci-kursove.com/userfiles/file/81346565442.pdf
http://drvision.org/wp-content/plugins/formcraft/file-upload/server/content/files/161415dbe010ac---38975860975.pdf
http://www.hon-ro.hu/userfiles/files/pexozularonukukexukojikas.pdf
http://chenruichem.com/upload/files/ninonexuzadukiwukugava.pdf
https://www.adler-leitishofen.de/wp-content/plugins/formcraft/file-upload/server/content/files/16140ccb9319cf---41043800818.pdf
http://eikenhorstgroep.nl/userfiles/file/makavumemabewowirojelelun.pdf
https://pernambucoimortal.com/imagens/files/nejor.pdf
http://boras-sjuharad.boj.se/uploads/userfiles/files/40682397148.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/

Embedded domains

ketchas.ru
www.asap-recruitment.net
studioconcept-stand.com
editora-arara-azul.com.br
lafenicealcamo.it
altaprecision.com
xinshifm.com
deleersnijder-bocaege.be
finestblogger.de
thepainter.asia
easyhypermarket.com
dangkyidol.com
portalcom-b2b.es
daquin-ferriere.fr
uroci-kursove.com
drvision.org
chenruichem.com
www.adler-leitishofen.de
eikenhorstgroep.nl
pernambucoimortal.com
boras-sjuharad.boj.se
www.w3.org
purl.org
ns.adobe.com
asigurareingermania.ro

Embedded IP addresses

74.179.77.204
48.211.4.16
74.179.71.159
57.155.101.212
20.247.184.197
52.110.12.45
74.178.76.44
4.230.171.124
203.26.79.13
52.123.252.203
172.66.2.5
135.233.95.144
20.184.175.21
20.76.201.171
52.123.129.14
51.116.253.168
40.79.167.10
4.150.223.103
20.42.65.94
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report