MALICIOUS — 4c32efae0e3d29a83ca9e9b768b3da9fbbb84387e76aba988da99f9e0c768869

MALICIOUS — 4c32efae0e3d29a83ca9e9b768b3da9fbbb84387e76aba988da99f9e0c768869 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 4c32efae0e3d29a83ca9e9b768b3da9fbbb84387e76aba988da99f9e0c768869
SHA-1: 722cf8ce3ea13a5b23e87dc1cb01dcb96affc04d
MD5: a047db8f7b5648fa1f56b43610588fc9
ssdeep: 1536:B/44poMij7ZjS9JK9OWyVPZ5WSfH8nfP8EnIFWC1uYUvp3WQpOC65GFQ:upD9yK9S0SfH8sEnK85piCa
TLSH: T11537CFF720D7CD9C7707AF137EE62198A486D38C11629E904089B76C997CEBDBB20590
Submitted as: 4c32efae0e3d29a83ca9e9b768b3da9fbbb84387e76aba988da99f9e0c768869
File type: pdf · Size: 72322 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 20 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://indicaperu.com/userfiles/file/tuguzapoxifovaxuveb.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://pistant.ru/uplcv?utm_term=before+you+start+up+pankaj+goyal+pdf+free+download, https://www.cukoyem.com.tr/wp-content/plugins/super-forms/uploads/php/files/2qqcrfpnkbtspobrn1nn3vth40/zufoxumirerolumok.pdf, https://giridhareye.org/ckfinder/userfiles/files/ramiw.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9612 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep._dosvc._tcp.local
_dosvc._tcp.local
desktop-hsgcbep
ntp.ubuntu.com
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\eb141288e467cff1503c03126f7f0b05.png - ad2d4b12a53831f8a0dec223868d2f337f06e34527f764eb13a5d7fd2f3b5ab2
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - c66a0aeaf62da80e7a69baccac2b8dd4ac90cb797c8c5f04a316d54054ebb2fb
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://pistant.ru/uplcv?utm_term=before+you+start+up+pankaj+goyal+pdf+free+download
https://www.cukoyem.com.tr/wp-content/plugins/super-forms/uploads/php/files/2qqcrfpnkbtspobrn1nn3vth40/zufoxumirerolumok.pdf
https://giridhareye.org/ckfinder/userfiles/files/ramiw.pdf
http://videocycling.info/files/file/kamokupizetitow.pdf
https://indicaperu.com/userfiles/file/tuguzapoxifovaxuveb.pdf
http://southportrubbish.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613a9041b9fa6---jilesuneb.pdf
https://corumosmanlimakina.com/js/ckfinder/userfiles/files/32862300076.pdf
http://www.sbawerribee.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1614e6cd031052---43829528684.pdf
http://tandartsindex.nl/images/uploads/xibaribivekew.pdf
http://ovecollection.com/royal/admin/images/products/file/fogevub.pdf
https://altonika.pro/files/fck/file/10179425310.pdf
http://lagrupacio.cat/file/49407069742.pdf
http://mobilesamara.com/img/files/file/25060762811.pdf
https://jyapa.com/jhuoyue/uploadfiles/18474862530.pdf
http://185.33.116.145/~acus01/upload/files/sutasifemobalememo.pdf
https://www.zaantraining.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16146ebf88f93f---34751596414.pdf
http://getawaynewzealand.co.nz/wp-content/plugins/formcraft/file-upload/server/content/files/16152476811239---dupejexibobiruxepo.pdf
http://liga-stf.ru/i/upload/files/nuwozaguwakilaja.pdf
http://nuk-amro.de/userfiles/file/58836703237.pdf
http://someteme.com/archivos/_20210908000948.pdf
http://abwbaltimore.com/uploads/files/59049194654.pdf
http://karcannakliyat.com/userfiles/file/mopomovo.pdf
http://aleshashop.net/uploaded_files/userfiles/files/divigupozubizobi.pdf
https://art-eria.pl/mandarynka/pliki/files/bivaxajuxoludodudajef.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

pistant.ru
giridhareye.org
videocycling.info
indicaperu.com
southportrubbish.com
corumosmanlimakina.com
www.sbawerribee.com.au
tandartsindex.nl
ovecollection.com
altonika.pro
mobilesamara.com
jyapa.com
www.zaantraining.nl
liga-stf.ru
nuk-amro.de
someteme.com
abwbaltimore.com
karcannakliyat.com
aleshashop.net
art-eria.pl
www.w3.org
purl.org
ns.adobe.com
www.cukoyem.com.tr
lagrupacio.cat

Embedded IP addresses

185.33.116.145
74.179.71.159
172.215.188.225
92.223.78.30
40.79.167.10
40.84.97.4
52.110.12.14
4.230.171.124
20.247.184.142
74.179.77.204
20.42.73.24
20.231.239.246
40.99.134.2
52.123.129.14
40.103.64.242
135.234.160.245
72.145.35.101
203.26.79.13
85.210.196.11
20.42.65.88
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report