MALICIOUS — 3f0503aef80536ccdccc9e4a2b34a9882699dd81110c60455b66e2ff9775f392

MALICIOUS — 3f0503aef80536ccdccc9e4a2b34a9882699dd81110c60455b66e2ff9775f392 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 54 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 3f0503aef80536ccdccc9e4a2b34a9882699dd81110c60455b66e2ff9775f392
• SHA-1: 37d1b767ab8cd2693701e0ab1966daca8b4d3bca
• MD5: f7fd83e21d4cf71bb9552e3e88a3b1d8
• ssdeep: 1536:HmwT7X/LWLvugc2GmGitz3uDtsFtNOASo9FBaFdFQWt01wt1WOpOaZEuxNT:TXQvug6mGMqts7RfUFGwtuaZPb
• TLSH: T1AB39D0F370A7DC0C7A4FEB03A4A6116DA58FDB886026E750C098B36C54BC5AD6B10A61
• Submitted as: 3f0503aef80536ccdccc9e4a2b34a9882699dd81110c60455b66e2ff9775f392
• File type: pdf · Size: 91865 bytes
• Verdict: malicious (99/100)

Detections (4 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1105
• T1566.002

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated malicious by URL analysis: http://annandale1963.com/clients/69704/File/tevatowal.pdf - network signal, weight 0.70, confidence 0.80
• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://timatey.kz/wp-content/plugins/super-forms/uploads/php/files/f05v79cprdd21qimckogth69t6/36283581057.pdf, https://mediabandit.com/wp-content/plugins/formcraft/file-upload/server/content/files/16086a3bbcc6f6---61507905843.pdf, https://lamaisonducoeur.ca/upload/editor/file/43903682462.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Contacted 11 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
• Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in Acrobat.exe (pid 8376) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

1017 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• desktop-hsgcbep._dosvc._tcp.local
• desktop-hsgcbep(1)._dosvc._tcp.local
• desktop-hsgcbep(2)._dosvc._tcp.local
• desktop-hsgcbep(3)._dosvc._tcp.local
• desktop-hsgcbep(4)._dosvc._tcp.local
• desktop-hsgcbep(5)._dosvc._tcp.local
• desktop-hsgcbep(6)._dosvc._tcp.local
• ntp.ubuntu.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• 23.40.52.85
• 40.126.14.164
• 162.159.142.9 US · San Francisco · AS13335 Cloudflare, Inc.
• 23.11.37.157
• 20.42.179.192 US · Moses Lake · AS8075 Microsoft Corporation

Dropped files

• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://feedproxy.google.com/~r/skout/mBVl/~3/PmAiG5ZyT-k/uplcv?utm_term=sampling+distribution+questions
• http://timatey.kz/wp-content/plugins/super-forms/uploads/php/files/f05v79cprdd21qimckogth69t6/36283581057.pdf
• https://mediabandit.com/wp-content/plugins/formcraft/file-upload/server/content/files/16086a3bbcc6f6---61507905843.pdf
• https://lamaisonducoeur.ca/upload/editor/file/43903682462.pdf
• https://vmkstroi.ru/wp-content/plugins/super-forms/uploads/php/files/fd298ca5262629800d487838616217f1/muderenimugukogireb.pdf
• http://sushiloverca.com/uploads/files/kagewe.pdf
• http://annandale1963.com/clients/69704/File/tevatowal.pdf
• http://pocatellocampfire.com/wp-content/plugins/super-forms/uploads/php/files/7goi3se777uae8e9tn8nfo4t8v/nenon.pdf
• https://kicksomeglass.com/wp-content/plugins/super-forms/uploads/php/files/10b977a47f5b7cbe55f44a65be7a211e/142017901.pdf
• http://sh8ke.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a0adfcd28a9---47939123611.pdf
• https://holocaustresearch.pl/nowy/photo/file/komazugisuwonokafebavof.pdf
• http://kolasinprevoz.rs/slike/files/xibop.pdf
• http://www.radioemka.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b54ce6eddfb---42788501389.pdf
• http://www.gaviprintpack.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d70a357293a---notexaro.pdf
• http://naturallymine-chicago.com/clients/867610/File/43448237599.pdf
• https://www.aserspa.net/wp-content/plugins/super-forms/uploads/php/files/dsm7mdojjodta7l5d4steltpik/vifijejeg.pdf
• https://www.growxponential.com/wp-content/plugins/super-forms/uploads/php/files/cv3qmjrb5e48528b5u14fkjpti/kofotalasorunu.pdf
• http://abwingssuffolk1.com/uploads/files/26899694339.pdf
• https://independentmusicleague.com/wp-content/plugins/super-forms/uploads/php/files/cc4e85647872250567dc98b8c913e25b/jepituxosevidopireditovo.pdf
• http://acecaalcoy.com/userfiles/file/toporojezuzasekad.pdf
• http://structurecreative.com/wp-content/plugins/formcraft/file-upload/server/content/files/16094c5e78dc7c---24946367094.pdf
• https://theemperorsoldclothes.co.uk/wp-content/plugins/super-forms/uploads/php/files/hir2m6bvesen3do1nebjin2678/48127578444.pdf
• http://mg001.cn/upload_fck/file/2021-5-7/20210507001805266718.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/

Embedded domains

• feedproxy.google.com
• mediabandit.com
• lamaisonducoeur.ca
• vmkstroi.ru
• sushiloverca.com
• annandale1963.com
• pocatellocampfire.com
• kicksomeglass.com
• sh8ke.com
• holocaustresearch.pl
• www.radioemka.com
• www.gaviprintpack.com
• naturallymine-chicago.com
• www.aserspa.net
• www.growxponential.com
• abwingssuffolk1.com
• independentmusicleague.com
• acecaalcoy.com
• structurecreative.com
• theemperorsoldclothes.co.uk
• mg001.cn
• www.w3.org
• purl.org
• ns.adobe.com
• timatey.kz

Embedded IP addresses

• 72.145.35.97
• 162.159.142.9
• 20.42.179.192
• 51.132.193.105
• 20.247.184.197
• 52.110.12.14
• 4.230.171.124
• 135.233.95.144
• 20.42.65.90
• 72.145.35.101
• 48.211.4.16

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report