MALICIOUS — 44e31e3c23920ec916a8622227fa87017798a4af5876d2888a8a444131b06b2f

MALICIOUS — 44e31e3c23920ec916a8622227fa87017798a4af5876d2888a8a444131b06b2f is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 44e31e3c23920ec916a8622227fa87017798a4af5876d2888a8a444131b06b2f
SHA-1: b8f0e8ac6c04cbac67c6919380d7c5713f33749e
MD5: 9f8c42b8fb909c86ee5884b2dd823f4b
ssdeep: 1536:w3Wu45s/f8Bi4iNCxRZduI21VdfpgsQxjWSUi6RUh58DPLWspO2Bba:Ru45s/kg4iVvpgmUMDPW2s
TLSH: T1F437CFF310A7DE4CB7D79F4319BA2199604AE7842061FBA05288F67CC47C57D7E14A90
Submitted as: 44e31e3c23920ec916a8622227fa87017798a4af5876d2888a8a444131b06b2f
File type: pdf · Size: 74121 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 17 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://olympicburger1988.com/uploads/files/tukezamuven.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://smidgel.ru/uplcv?utm_term=how+to+transfer+music+from+laptop+to+android+phone+wirelessly, https://accesoriosalmayor.com/images/userfiles/file/74509835618.pdf, https://savitravel.ro/ckfinder/userfiles/files/niteguxuwubesososagovegif.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9600 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
250.255.255.239.in-addr.arpa
desktop-hsgcbep
ntp.ubuntu.com
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\3db6c0b864b4f1133540e3af92e8c554.png - bd8014f1e810449f07dddf31ffbddf0a9ff57b8d357d8ec75f0a114ac63c95b6
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 8782dbfffe8197263d6a7ccc22c9bcf04033c5ffe5634ebc36c1bc001612ff93
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://smidgel.ru/uplcv?utm_term=how+to+transfer+music+from+laptop+to+android+phone+wirelessly
https://accesoriosalmayor.com/images/userfiles/file/74509835618.pdf
https://savitravel.ro/ckfinder/userfiles/files/niteguxuwubesososagovegif.pdf
http://olympicburger1988.com/uploads/files/tukezamuven.pdf
http://usarsenal.it/userfiles/files/kizudigafawerepexakidefe.pdf
http://buren-kompanie.de/userfiles/files/midewovuvavadadoxem.pdf
http://www.santamyoga.be/images/file/25123675846.pdf
http://angelescare.com/userfiles/file/32639624256.pdf
http://ppfi-online.com/userfiles/file/97947104834.pdf
http://35ct1.com/images/ckImageFiles/files/38332767889.pdf
http://www.bridalchapel.com/wp-content/plugins/formcraft/file-upload/server/content/files/16130f8e074dd2---71789076238.pdf
http://www.alfainstal.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16138c80f9351b---xotetu.pdf
http://www.taxivanclass.com/uploads/ckfinder/files/45766399478.pdf
http://chocoenglish.com/_UploadFile/Images/file/22786658523.pdf
http://herborgthailand.com/file_media/file_image/file/97063393761.pdf
http://stroyvodservice.ru/upload/File/79972450804.pdf
http://www.cuadernos.in/wp-content/plugins/formcraft/file-upload/server/content/files/1613b6918612b2---84584537389.pdf
http://www.kliningstroy.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16137675fcde54---18260719477.pdf
http://toyotaquangninh.org/data/dulieu/files/73167846228.pdf
https://lideregitimpaketleri.com/calisma2/files/uploads/67858357744.pdf
https://championsforchildren.org/wp-content/plugins/super-forms/uploads/php/files/e323adce41727ab211d6b96dc33c195b/98278359895.pdf
http://weingut-suppan.at/files/nixuxoxoteripekagadefex.pdf
https://nhahangthanghuong.com/uploads/files/xafaditoxi.pdf
http://world-housing.jp/ckfinder/userfiles/files/45350143297.pdf
http://zzweien.com/d/files/vefigozojapulumofar.pdf

Embedded domains

smidgel.ru
accesoriosalmayor.com
olympicburger1988.com
usarsenal.it
buren-kompanie.de
www.santamyoga.be
angelescare.com
ppfi-online.com
35ct1.com
www.bridalchapel.com
www.alfainstal.pl
www.taxivanclass.com
chocoenglish.com
herborgthailand.com
stroyvodservice.ru
www.cuadernos.in
www.kliningstroy.ru
toyotaquangninh.org
lideregitimpaketleri.com
championsforchildren.org
nhahangthanghuong.com
world-housing.jp
zzweien.com
www.w3.org
purl.org

Embedded IP addresses

52.110.12.19
4.247.188.233
4.230.171.124
74.179.77.204
74.179.77.164
74.178.240.61
20.231.239.246
40.99.133.226
52.123.128.14
40.104.4.2
74.179.71.159
203.26.79.13
85.210.196.11
20.184.175.18
172.170.180.133
20.42.65.89
20.42.65.94

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report