MALICIOUS — 40d8f8bdc62f1ea91a45e4304aed207e039488813ab59ae72555e45412ae9a69

MALICIOUS — 40d8f8bdc62f1ea91a45e4304aed207e039488813ab59ae72555e45412ae9a69 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 40d8f8bdc62f1ea91a45e4304aed207e039488813ab59ae72555e45412ae9a69
SHA-1: b0f9d7fd1fa1123fdc721bc8de73c66ee7fc341b
MD5: 11f9e9c4153c450af1bc0b4106521ab1
ssdeep: 1536:+FbjJ2ndZ/qZ85viNB1Y5PI3Jszk4f2ZVePiJo+Wv4Qlx0AHGW2GXrsXBdYxWApY:k/09PiNfuzk4uZVhxWAQz0AHfbazY46Q
TLSH: T13239D0F320ABEE5C764ADF47B9BB15696449EAC45072DE7044C87A3C84BC9FE2E10850
Submitted as: 40d8f8bdc62f1ea91a45e4304aed207e039488813ab59ae72555e45412ae9a69
File type: pdf · Size: 90636 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 22 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://guss-ex.de/uploads/fck/file/pedogotapomera.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://ventana-sur.com/wp-content/plugins/formcraft/file-upload/server/content/files/16150368521c37.pdf, http://guss-ex.de/uploads/fck/file/pedogotapomera.pdf, http://www.zywawiara.pl/pliki/jekelunarifasuxazenofam.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9696 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787791578&P2=404&P3=2&P4=QehdVEECoR6NmROh4ZMkm%2f5h%2f9T8Vay9pNKROypDjmz%2bxknX7KmZpTAcf7QtAEyyJ3oQWEXj8PEffl36LnTCCQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787791600&P2=404&P3=2&P4=mHti5Py3oOdgkRuDbiyhew7ka4%2bmXRjtwmDbb0J3quBbAdKEB8C7raPSGbTVE6Thjm0SOB8PkohTK%2feovf7law%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 6462603cffac419d0d7a7efd1e80db9988d47cd87e29e5aa6da19f8a7cb7b1e7
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\819af05c46733943d89672a189d4e4b6.png - f7a4a7ff319c7dcce20da4ad32fbcbf10e02399ae5a34de0c7b87872b96f675f
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/GLLx1DTH0VQ/uplcv?utm_term=self+recognition+example
https://ventana-sur.com/wp-content/plugins/formcraft/file-upload/server/content/files/16150368521c37.pdf
http://guss-ex.de/uploads/fck/file/pedogotapomera.pdf
http://www.zywawiara.pl/pliki/jekelunarifasuxazenofam.pdf
http://vwtint.com/userData/board/file/95439421553.pdf
http://www.finanzanlagen-honorarberatung.de/wp-content/plugins/formcraft/file-upload/server/content/files/1613c5b184960d---xosobawodubazaw.pdf
http://hyunsin.net/userfiles/file/8390912849.pdf
https://nic-irq.com/userfiles/files/xosiz.pdf
http://www.farmaciabergua.com/userfiles/files/29484802456.pdf
http://philipwillettelaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/renazolasemeweso.pdf
http://cuacuongiare.vn/upload/files/getajuganibegosojujumudi.pdf
http://mfcpavpos.ru/file/44400278017.pdf
http://telektrans.hu/editor_up/wevuvuvikoteninematufu.pdf
http://emaaravm.net/upload/files/77923704857.pdf
http://k1a.ru/images/files/file/33812064431.pdf
http://philipwillettelaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/7761510130.pdf
https://grandhotelushba.com/userfiles/file/weroxawupow.pdf
https://gruppopolidori.com/upload/image/file/gobise.pdf
https://www.renouer-auxerre.com/ckfinder/userfiles/files/lulupov.pdf
http://www.aaar.cat/assets/js/ckfinder/userfiles/files/92702898552.pdf
https://thepainter.asia/upload/files/mamaxajeliveladetagukunox.pdf
http://hoangduy.vn/vn/files/nenumopakepexidepabef.pdf
https://dragonexpressml.com/userfiles/files/82231831913.pdf
https://spvi.cn/filespath/files/20211002181455.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

feedproxy.google.com
ventana-sur.com
guss-ex.de
www.zywawiara.pl
vwtint.com
www.finanzanlagen-honorarberatung.de
hyunsin.net
nic-irq.com
www.farmaciabergua.com
philipwillettelaw.com
mfcpavpos.ru
emaaravm.net
k1a.ru
grandhotelushba.com
gruppopolidori.com
www.renouer-auxerre.com
thepainter.asia
dragonexpressml.com
spvi.cn
www.w3.org
purl.org
ns.adobe.com
cuacuongiare.vn
telektrans.hu
www.aaar.cat

Embedded IP addresses

34.54.88.138
172.66.0.227
172.215.188.232
20.42.179.204
52.123.252.194
52.110.12.40
4.230.171.124
4.247.188.233
20.247.185.124
20.165.94.54
135.233.95.144
74.178.76.128
52.123.129.14
172.178.240.163
72.145.35.100
203.26.79.13
4.150.223.97
74.178.76.44
92.223.78.30
48.192.143.121
20.42.73.27
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report