MALICIOUS — 4d1547ca4b0e256b740ac72a915ac592337383a62ee41bdb222916338b78dd1f

MALICIOUS — 4d1547ca4b0e256b740ac72a915ac592337383a62ee41bdb222916338b78dd1f is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 4d1547ca4b0e256b740ac72a915ac592337383a62ee41bdb222916338b78dd1f
SHA-1: 0fe4d7c1d80ab24ff8605b7c4e559abba88f9c11
MD5: d201fa8c81cd7be78c3379257eba0781
ssdeep: 1536:NXKc4QdtXGX/vIt2IvyIB8DjUs0O5WKT6jnUa8WOpOaZi/Wrm0:AcZdtOvIgIvGX0OZ6X5aZAW9
TLSH: T1A937C0F321ABDE5C7B47CB03A9FB21AD5596D7C4212299805084772CD9BC9BEBF00921
Submitted as: 4d1547ca4b0e256b740ac72a915ac592337383a62ee41bdb222916338b78dd1f
File type: pdf · Size: 70588 bytes
Verdict: malicious (95/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 95/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Contacted 20 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://minervatech.work/js/ckfinder/userfiles/files/17869515413.pdf, http://fcv-bo.org/data/fcv-bo/userfiles/file/47535211729.pdf, https://dortmundpools.com/contents/files/lodizigewuti.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9628 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787826353&P2=404&P3=2&P4=TwHRUScWL8q3raE5zoZ0nyfKhn1%2b3Wd%2fKxWXJvogSReiRZW7nU0gCTTpP4eKY5rK%2fu5aOf7n%2fcUeT5k4d8JJ4A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787826381&P2=404&P3=2&P4=Kt%2fUzz8aPAr2hJkHJmbEhN4x35m1vtWUb8H9DDXLisd9p6s77JNj541a08vv97Jp3neyneXle9SQRQJ04xY2%2fA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\3dbd0a11584f25429eb29bd7302a3ab9.png - 7ddd21fe1b8c1d8e2209f3fdff8352db5696769f7843531a0931e8944d4c33b3
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - aa0077d7e06ac5b09b471b8d79a7b2402de26cdc51cdb265118f3cf43fbf4ca3
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/ngfLrbzwjls/uplcv?utm_term=student+exploration+rna+and+protein+synthesis+gizmo
https://minervatech.work/js/ckfinder/userfiles/files/17869515413.pdf
http://fcv-bo.org/data/fcv-bo/userfiles/file/47535211729.pdf
https://dortmundpools.com/contents/files/lodizigewuti.pdf
http://kbautotech.com/board/datafiles/imagefile/gesuvuviragisimet.pdf
http://poddertradingandindustries.com/userfiles/file/gakov.pdf
https://kodeac.com/wp-content/plugins/super-forms/uploads/php/files/jovbejgqfrsn5on429kp1iijj3/40770949545.pdf
https://qualitycountscleaning.com/wp-content/plugins/super-forms/uploads/php/files/99fde44d9ab2549144ae4e31f94be184/vudulujegusoronak.pdf
http://around-sicily.net/userfiles/file/xurelezifu.pdf
http://izeninfo.net/admin/upload/files/16492330239.pdf
https://www.denisonlandscaping.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614c3fcc72e33---nifugezoleferapuxozema.pdf
http://darstin.com/userfiles/files/52859753516.pdf
https://drahmetbostanci.com/wp-content/plugins/formcraft/file-upload/server/content/files/16132c9ac81a4a---rukovanojonemavobag.pdf
https://theloneranger.tv/clients/loneranger/ckfinder/userfiles/files/tadosiwoxexago.pdf
http://wixoon.hu/upload/file/dazodononibinelitoxuraza.pdf
http://doradcyprawni.com/images/pliki/nonutewobijabuvojax.pdf
http://www.adanakursmerkezi.com/wp-content/plugins/formcraft/file-upload/server/content/files/16138518fe9dcb---ladudobuxo.pdf
http://olech-rzeszow.pl/userfiles/file/duposopewubi.pdf
http://garderoba.sk/images/_file/lifelokilok.pdf
http://robwalker.net/fckupload/file/dodefiborewe.pdf
http://karczma-zaborow.pl/userfiles/file/muzukixazo.pdf
https://earthchartercities.org/wp-content/plugins/formcraft/file-upload/server/content/files/161559571bac9f---57764930794.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/

Embedded domains

feedproxy.google.com
minervatech.work
fcv-bo.org
dortmundpools.com
kbautotech.com
poddertradingandindustries.com
kodeac.com
qualitycountscleaning.com
around-sicily.net
izeninfo.net
www.denisonlandscaping.com
darstin.com
drahmetbostanci.com
theloneranger.tv
doradcyprawni.com
www.adanakursmerkezi.com
olech-rzeszow.pl
robwalker.net
karczma-zaborow.pl
earthchartercities.org
www.w3.org
purl.org
ns.adobe.com
wixoon.hu
garderoba.sk

Embedded IP addresses

48.211.4.16
162.159.142.9
40.79.150.122
52.123.252.246
52.230.60.54
52.110.12.47
172.215.188.232
4.230.171.124
203.26.79.13
74.178.76.128
74.179.77.164
52.123.252.218
20.52.64.200
52.123.128.14
20.165.94.46
51.104.15.252
40.84.97.4
48.200.63.27
4.150.223.102
52.148.114.188

File paths

H:\Z

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report