MALICIOUS — 3f68e0ad83a4e5c6fa15471479267a0278dad229359b3e2244864e4d9c9fbaba

MALICIOUS — 3f68e0ad83a4e5c6fa15471479267a0278dad229359b3e2244864e4d9c9fbaba is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 54 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 3f68e0ad83a4e5c6fa15471479267a0278dad229359b3e2244864e4d9c9fbaba
SHA-1: 27a6257d8d3937a53a476b69b4b6a36f3ac1c96e
MD5: e5fbab211c8324ef40822cddf5afc24e
ssdeep: 1536:PVh6Epgulzu3jz9YQqY2SdRJLJS2uNpQvosyZpObWOpOwrKWD4a6Doq/BuNnRtHQ:XRgulzVQhRJLGpd24wr936n/BSo
TLSH: T1423AD0F360ABDDAC379B8F4319EE106DB049DB84217396A0408CBA7DE17C9BD2E14561
Submitted as: 3f68e0ad83a4e5c6fa15471479267a0278dad229359b3e2244864e4d9c9fbaba
File type: pdf · Size: 97577 bytes
Verdict: malicious (99/100)

Detections (4 of 54 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://ps-chiptuning.hu/userfiles/files/kedupopovubufividiziva.pdf - network signal, weight 0.70, confidence 0.80
Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://incomsistema.ru/ckfinder/userfiles/files/58700956105.pdf, https://www.gsccn.it/wp-content/plugins/formcraft/file-upload/server/content/files/1613be5ed1af46---lumulobebejezum.pdf, https://samsungklima.net/upload/ckfinder/files/tupelokejimuroragusomuves.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Contacted 12 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

983 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
23.40.52.85
192.168.122.109
23.11.37.157
172.66.2.5 US · San Francisco · AS13335 Cloudflare, Inc.
20.190.167.150
52.110.12.47 AU · Sydney · AS8075 Microsoft Corporation
23.198.40.44
4.230.171.124 KR · Seoul · AS8075 Microsoft Corporation
4.247.188.233 IN · Pune · AS8075 Microsoft Corporation
23.33.238.114
20.190.167.148
20.247.184.197 SG · Singapore · AS8075 Microsoft Corporation

Dropped files

root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/skout/mBVl/~3/3CAf4wW3hvY/uplcv?utm_term=when+i+stand+up+fast+i+get+lightheaded
http://incomsistema.ru/ckfinder/userfiles/files/58700956105.pdf
https://www.gsccn.it/wp-content/plugins/formcraft/file-upload/server/content/files/1613be5ed1af46---lumulobebejezum.pdf
https://samsungklima.net/upload/ckfinder/files/tupelokejimuroragusomuves.pdf
http://www.dagmarsvendova.cz/admin/js/ckfinder/userfiles/files/tevutigomasagulimojakut.pdf
http://beijingxinzhi.com/userfiles/file/20210929002710_191094412.pdf
https://38e5bbdfe8be.gdziezjesc.info/userfiles/file/sijop.pdf
https://at1apigroup3.com/contents/files/vaxerotonarew.pdf
http://ps-chiptuning.hu/userfiles/files/kedupopovubufividiziva.pdf
http://brno-skoleniridicu.cz/ckfinder/userfiles/files/samugegumukilodufade.pdf
https://www.loisirs-auto-occasion.fr/ckfinder/userfiles/files/45115455601.pdf
http://aktifmedya.com/dosyalar/files/zowugukojuwodebu.pdf
http://sjatupornservices.com/file_media/file_image/file/95508622434.pdf
http://mariancozma.com/_user/file/telezavejebu.pdf
http://kiko168.com/UploadFile/file/20210929192216768.pdf
http://re-media.ru/foto/ck/files/lovetojalito.pdf
https://microfocus-realize2020mea.com/wp-content/plugins/super-forms/uploads/php/files/271982fe7cfb034e053f1a3613e3a207/76764303232.pdf
https://baohohoanglong.com/userfiles/file/36054246442.pdf
http://abwhopewell.com/uploads/files/30983963913.pdf
http://caycanhtuyhien.com/uploads/image/files/9293033871.pdf
http://styrexon.cz/userfiles/file/takejezu.pdf
http://changrung.com/ckfinder/userfiles/files/82544938899.pdf
http://chiangmai-clean.com/user_img/files/12664748245.pdf
https://dammesliepas.lv/ckfinder/userfiles/files/58163851952.pdf
https://yp05.com/_UploadFile/Images/file/jurun.pdf

Embedded domains

feedproxy.google.com
incomsistema.ru
www.gsccn.it
samsungklima.net
beijingxinzhi.com
38e5bbdfe8be.gdziezjesc.info
at1apigroup3.com
www.loisirs-auto-occasion.fr
aktifmedya.com
sjatupornservices.com
mariancozma.com
kiko168.com
re-media.ru
microfocus-realize2020mea.com
baohohoanglong.com
abwhopewell.com
caycanhtuyhien.com
changrung.com
chiangmai-clean.com
yp05.com
alkathirilaw.com
www.w3.org
purl.org
ns.adobe.com
www.dagmarsvendova.cz

Embedded IP addresses

172.233.212.224
203.26.79.13
104.208.16.94
40.84.97.4
172.66.2.5
52.110.12.47
4.230.171.124
4.247.188.233
20.247.184.197
20.165.94.63
4.150.223.98
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report