MALICIOUS — dajawo.pdf

MALICIOUS — dajawo.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 47203685fc7cafd4b7c57cbb1788f771c815dcfb4e111d95e8ac931b3a5b6e1a
SHA-1: 25b15d7412de5625311c45dd5266d09c343923ee
MD5: 0c82e65a8d79fe53d47755ef7ece4b48
ssdeep: 1536:uLqhW7FXYdfXSvxt3YiklZnw98tcAVjEckUuuw+Wn3KuqODL4jNWOpOaZEaPZIg:PKFXYdkx9Ys98tbjELnis4jGaZEQl
TLSH: T10438D0F31197EC9C36474F036AAA01ADB48AE3886062E7B051CCBB6CC57C57D6F14A61
Submitted as: dajawo.pdf
File type: pdf · Size: 80043 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 23 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://www.champcaregivers.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613c8f446807a---xosinipifadegebasewafibu.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://garglob.ru/uplcv?utm_term=logcat+filter+by+package, http://www.champcaregivers.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613c8f446807a---xosinipifadegebasewafibu.pdf, https://evocative.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1613e51eb664bd---vipumoforolupopa.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9678 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
desktop-hsgcbep
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - b1fd043fe7c9782069616a6d19f44062894e3096ca57835c0ac496d161776986
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\bcb7b4c00990fbc3f631eda58b041dfe.png - 9856a7d7dc6fbf5856b8c7bfb2911b7afdd3491d110a3fc2253d6ece75cb6935
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://garglob.ru/uplcv?utm_term=logcat+filter+by+package
http://www.champcaregivers.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613c8f446807a---xosinipifadegebasewafibu.pdf
https://evocative.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1613e51eb664bd---vipumoforolupopa.pdf
http://abbuffalowings.com/uploads/files/96030751463.pdf
http://esoftland.com/userfiles/file/3727774392.pdf
http://giadinhlaurenso.org/upload/files/68067359886.pdf
http://rorolaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/buvorogesogo.pdf
http://xn--eyt274i.com/upload/files/31086774658.pdf
http://benetalent.com/upload/files/20201042668.pdf
http://zhongguohuachun.com/d/files/72215448186.pdf
https://hacunamatata.ru/wp-content/plugins/super-forms/uploads/php/files/250c98a8c8f0e47bc5c2a05258ddfae9/kunafog.pdf
http://moneymaker-gold.de/files/28701470114.pdf
http://sbs-group.co/userfiles/files/zakekafupojenovik.pdf
http://smartdeal.pl/files/upload/files/40102697634.pdf
http://www.johnknox.ch/wp-content/plugins/formcraft/file-upload/server/content/files/16136c0533c762---52158890693.pdf
http://nemalipics.com/21714219419.pdf
http://emailreceptionist.net/userfiles/file/87848685356.pdf
http://zavalinka.by/var/upload/file/36338526217.pdf
https://tutorbolivia.com/userfiles/file/66701057519.pdf
http://shipagents.nl/uploadfiles/file/53870873215.pdf
https://lensmam.com/userfiles/file/xegunugitirekopagegub.pdf
http://cosmik-kinoteatr.ru/sadm_files/tevunajatonomumeje.pdf
http://www.otevrenysklep.cz/ckfinder/userfiles/files/rozuv.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/

Embedded domains

garglob.ru
www.champcaregivers.com
evocative.ru
abbuffalowings.com
esoftland.com
giadinhlaurenso.org
rorolaw.com
xn--eyt274i.com
benetalent.com
zhongguohuachun.com
hacunamatata.ru
moneymaker-gold.de
sbs-group.co
smartdeal.pl
www.johnknox.ch
nemalipics.com
emailreceptionist.net
tutorbolivia.com
shipagents.nl
lensmam.com
cosmik-kinoteatr.ru
www.w3.org
purl.org
ns.adobe.com
zavalinka.by

Embedded IP addresses

172.172.255.218
20.184.175.18
20.42.73.26
74.178.240.61
20.42.73.30
20.42.179.204
52.110.12.51
52.110.12.20
4.230.171.124
57.155.104.224
4.144.132.114
135.232.92.97
20.236.44.162
135.233.95.144
52.123.129.14
72.154.7.99
203.26.79.13
52.123.252.224
135.234.160.244
74.178.232.29
20.42.73.25
142.250.183.35
13.89.179.12

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report