MALICIOUS — 4d26a2102b8e047410e0296d6dc1b726b667f15cd8265d41554647d5ecf580a3

MALICIOUS — 4d26a2102b8e047410e0296d6dc1b726b667f15cd8265d41554647d5ecf580a3 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 4d26a2102b8e047410e0296d6dc1b726b667f15cd8265d41554647d5ecf580a3
SHA-1: e1d0750884621f0f834644485f1aab655bd8ebec
MD5: 4125f616c8f7d176fd91a74299b49c3b
ssdeep: 1536:flzdAmsKYuIdtsKFps71tz5ZdRNLJGJZY2J6WZJ3vOAlWspO2zkQ:lPjY5rXFpsLztTLUJ9JroAM23
TLSH: T18738D0F33197EE9C3649DF43AAEB1198648AD38C2272EED04484766CD67C5BC7E00A51
Submitted as: 4d26a2102b8e047410e0296d6dc1b726b667f15cd8265d41554647d5ecf580a3
File type: pdf · Size: 84039 bytes
Verdict: malicious (98/100)

Detections (4 of 54 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 98/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://uniondeautoescuelas.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612fb655d9226---jokinobuzujelox.pdf, https://www.rongoldmanlaw.com/system/js/back/ckfinder/userfiles/files/8300424657.pdf, https://bawwabatrizq.com/userfiles/file/48099358662.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Contacted 9 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

1008 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
23.40.52.85
142.250.195.238
23.11.37.157
20.184.175.13 US · San Jose · AS8075 Microsoft Corporation
4.247.188.224 IN · Pune · AS8075 Microsoft Corporation
20.190.142.167
52.123.252.238 AU · Sydney · AS8075 Microsoft Corporation
23.33.238.178
52.110.12.28 AU · Sydney · AS8075 Microsoft Corporation
4.230.171.124 KR · Seoul · AS8075 Microsoft Corporation
23.33.238.173
23.33.238.112

Dropped files

root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/A3Ryygt5BCM/uplcv?utm_term=how+to+set+up+group+chat+on+android
http://uniondeautoescuelas.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612fb655d9226---jokinobuzujelox.pdf
https://www.rongoldmanlaw.com/system/js/back/ckfinder/userfiles/files/8300424657.pdf
https://bawwabatrizq.com/userfiles/file/48099358662.pdf
https://net-mex.hu/ckfinder/userfiles/files/vadovunuki.pdf
https://nabsangram.com/userfiles/file/88936813852.pdf
http://festivaldeliteraturadepereira.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613421bf06e17---jotoki.pdf
http://gma.ge/admin/ckeditor/ckfinder/userfiles/files/davajolisewebepewi.pdf
https://www.pietri-automobiles.com/wp-content/plugins/super-forms/uploads/php/files/krgoao4jvntd8m33p3jns6bg0k/65293132101.pdf
http://allnatureint.com/userfiles/file/8622814674.pdf
https://www.digitalsofts.com/wp-content/plugins/formcraft/file-upload/server/content/files/161413032ecb41---mikotifumid.pdf
http://amtusa.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613bff17ccfca---82442795683.pdf
https://bike-accessories.supersites.gr/content/ckfinder/files/zemimefivez.pdf
http://vietdubai.com/userfiles/file/lopigobo.pdf
http://aristosaigonhotel.vn/uploads/files/sakevidezifisoduzokof.pdf
http://nfc.soo.jp/file/48659960656.pdf
http://eyupsifalibitkiler.com/resimler/files/negukinobedete.pdf
https://www.inter-tube.co.uk/wp-content/plugins/super-forms/uploads/php/files/a1a191b351fcc4a3a8454cf2c7a33e70/26709215060.pdf
http://gzlmjx.com/data/home/bxu2343160066/htdocs/uploadfile/files/57875584860.pdf
http://satyamtracparts.com/userfiles/file/najuvivuxasokon.pdf
http://kehlux.lu/userfiles/files/nozedepebedezudije.pdf
https://lanna-flyingclub.com/ckfinder/userfiles/files/nowuwaximuxifizasi.pdf
http://ykzn8.com/upfiles/editor/files/bozeru.pdf
http://greenflameenergy.com/userfiles/file/94473378886.pdf
https://doluhosting.com/calisma2/files/uploads/63828486324.pdf

Embedded domains

feedproxy.google.com
uniondeautoescuelas.com
www.rongoldmanlaw.com
bawwabatrizq.com
nabsangram.com
festivaldeliteraturadepereira.com
www.pietri-automobiles.com
allnatureint.com
www.digitalsofts.com
amtusa.com
vietdubai.com
nfc.soo.jp
eyupsifalibitkiler.com
www.inter-tube.co.uk
gzlmjx.com
satyamtracparts.com
lanna-flyingclub.com
ykzn8.com
greenflameenergy.com
doluhosting.com
www.w3.org
purl.org
ns.adobe.com
net-mex.hu
gma.ge

Embedded IP addresses

20.184.175.13
4.247.188.224
52.123.252.238
52.110.12.28
4.230.171.124
20.42.65.94
74.178.240.61
92.223.78.30
51.132.193.105

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report