MALICIOUS — 4aadab878ac02bc1bcf6ee4b5f71443a7a23aff7661f8b2b94d5c3a1a57c7031

MALICIOUS — 4aadab878ac02bc1bcf6ee4b5f71443a7a23aff7661f8b2b94d5c3a1a57c7031 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 4aadab878ac02bc1bcf6ee4b5f71443a7a23aff7661f8b2b94d5c3a1a57c7031
• SHA-1: a981a404f184f3f073d8b6f6f3fa97bbd09bc934
• MD5: f798fc78c3bd1d32bca7fc0150566860
• ssdeep: 1536:8xnEiydZRXi7TiA7rryzvJ0hGWaWkhC6oQmQbw5ZYysli9:anqfS7TP7qDJ2GWwrB9UfYysi
• TLSH: T1F237CFF7319BEDCD360ABB837A7A155C61A6C6D07072AA604484F66D84BC6FE3F10910
• Submitted as: 4aadab878ac02bc1bcf6ee4b5f71443a7a23aff7661f8b2b94d5c3a1a57c7031
• File type: pdf · Size: 70277 bytes
• Verdict: malicious (84/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!F798FC78C3BD
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1105
• T1566.002

Why this verdict

The malicious score of 84/100 is the fusion of 6 weighted signals:

• Embedded link rated malicious by URL analysis: https://uploads.strikinglycdn.com/files/3a45b389-21f9-4f86-ad48-08bbbf4ab234/broan_range_hood_buttons_not_working.pdf - network signal, weight 0.70, confidence 0.80
• Contacted 16 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
• Embedded network infrastructure: https://bologen.ru/award?keyword=amazing+love+chords+in+g+pdf, http://mediaverifiedbadge.com/4839344289g0qwv.pdf, https://cdn.sqhk.co/fupokiwil/ThhlRQs/87409320346.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9692 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• desktop-hsgcbep
• ntp.ubuntu.com
• 250.255.255.239.in-addr.arpa
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Dropped files

• C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - a9f6ce0e6f47c80bf207429aef692648f1b2d04a6d64b8cb07958e5c080d5ac7
• C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\a63f028afbd36b0911168bdec2cf08c5.png - 8e2191769f61a9d32717074b298509df915d313d3f0cecfc1aa727a819673381
• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://bologen.ru/award?keyword=amazing+love+chords+in+g+pdf
• http://mediaverifiedbadge.com/4839344289g0qwv.pdf
• https://cdn.sqhk.co/fupokiwil/ThhlRQs/87409320346.pdf
• http://shop-kid-toys.online/frommers_parisf3s3s.pdf
• http://diwokaxojizo.iblogger.org/graphic_design_book_cover_template.pdf
• https://cdn.sqhk.co/xaxovowupofa/jargjjb/deeeep._io_beta_animals.pdf
• https://uploads.strikinglycdn.com/files/3a45b389-21f9-4f86-ad48-08bbbf4ab234/broan_range_hood_buttons_not_working.pdf
• http://zirigifoxusol.22web.org/barefoot_gen_book.pdf
• http://zumebixakefeta.epizy.com/48083242751.pdf
• http://butalinonoruma.scienceontheweb.net/wisixilujene.pdf
• https://cdn.sqhk.co/wufotubi/TDhhK52/abcmouse_games_that_i_can_play.pdf
• http://vimozav.epizy.com/xivalusukipalumo.pdf
• http://duxepivol.myartsonline.com/xorosipojomebinot.pdf
• http://jizuvopanusin.rf.gd/water_cycle_diagram_to_label.pdf
• https://uploads.strikinglycdn.com/files/efc99347-7ebf-45a7-aea4-7a5196c9597b/lanopelewulunorezamaxix.pdf
• http://kugefosames.rf.gd/51673996252.pdf
• http://rubeatyshop.xyz/300029227453hoii.pdf
• http://gnoogle.site/wing_chun_kung_fu_the_wooden_dummyrquwf.pdf
• http://ejinaya.com/call_of_zone_modghuol.pdf
• https://cdn.sqhk.co/pazaxefuma/gjiMUja/zombie_fires_2020.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/

Embedded domains

• bologen.ru
• mediaverifiedbadge.com
• cdn.sqhk.co
• shop-kid-toys.online
• diwokaxojizo.iblogger.org
• uploads.strikinglycdn.com
• zirigifoxusol.22web.org
• zumebixakefeta.epizy.com
• butalinonoruma.scienceontheweb.net
• vimozav.epizy.com
• duxepivol.myartsonline.com
• rubeatyshop.xyz
• gnoogle.site
• ejinaya.com
• www.w3.org
• purl.org
• ns.adobe.com
• jizuvopanusin.rf.gd
• kugefosames.rf.gd

Embedded IP addresses

• 85.210.196.11
• 20.42.73.31
• 40.84.97.4
• 20.247.184.142
• 52.110.12.52
• 4.247.188.233
• 4.230.171.124
• 4.150.223.96
• 135.233.95.144
• 20.76.201.171
• 52.123.128.14
• 104.46.162.229
• 135.233.45.221
• 135.232.92.34
• 203.26.79.13
• 52.168.112.66

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report