MALICIOUS — 4de29a80f633846a44076f558f8c43f451bdd24e4a8e715bd652dd0a7d14b801

MALICIOUS — 4de29a80f633846a44076f558f8c43f451bdd24e4a8e715bd652dd0a7d14b801 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 4de29a80f633846a44076f558f8c43f451bdd24e4a8e715bd652dd0a7d14b801
SHA-1: 08642916e252227ed798df5a3c486e4f50d2726b
MD5: dfb0bbc2a6177f3c6c3aebf3c8324aa4
ssdeep: 1536:8+6ejTSnk54AM5A9eij5+rmefZGR3OhQv2c2NWapOtQlcZ7DGxWkgLFl5rqSvMe:N+q4x5A9hFR4Qu+tQlm7DGV85
TLSH: T1AA38C0F300ABDE0C768BDB0326FB156DA047D38964A3DA8040897BADD5BC57DBE10952
Submitted as: 4de29a80f633846a44076f558f8c43f451bdd24e4a8e715bd652dd0a7d14b801
File type: pdf · Size: 81956 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://damutech.kz/upload/2021/09files/210901131009087835v65de.pdf - network signal, weight 0.70, confidence 0.80
Contacted 16 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://alajwakh.com/uploaded_files/userfiles/files/xesoguduvalaxexijobus.pdf, https://firmabudowlanawalczak.pl/web/uploads/files/padagatiri.pdf, http://xszhuhai.com/uploadfiles/files/mobexuwarezamagezabe.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9555 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787786152&P2=404&P3=2&P4=EDlC41aXMOyXsWxIzHA61x%2fmJF1kIPaEMpQmYlCcta6CXSEW%2fcyUadLxq7DcMfa10wpAtBwM7XAh5fdDZ4IVfA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787786239&P2=404&P3=2&P4=RwAinnK9aicW4GZHNcrCWKAJALX67VwHvftOYm8bMGWR9pFritYTnb0EBzd91Cdsdkm14N2As%2bW5Ba4QzakalQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - ddcc2d8c77d1b4786b4b95bc3817574ac356569e3eeb6afb8ac69aa01df67fb5
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\2ef7f42865de23cb13534cb74667e50e.png - 8aa60b537b8c29f28d02ae4567cff4f0fec83e8faf9689b2797a93ef37eb6471
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/skout/mBVl/~3/cv9VXjIrmdE/uplcv?utm_term=naruto+ultimate+ninja+impact+ppsspp+iso
http://alajwakh.com/uploaded_files/userfiles/files/xesoguduvalaxexijobus.pdf
https://firmabudowlanawalczak.pl/web/uploads/files/padagatiri.pdf
http://damutech.kz/upload/2021/09files/210901131009087835v65de.pdf
http://xszhuhai.com/uploadfiles/files/mobexuwarezamagezabe.pdf
http://ikra-ekb.ru/files/fckeditor/file/25315155982.pdf
https://fa-vietnam.com/webroot/img/files/gisunuvesawizotibi.pdf
http://mikomisushiwc.com/uploads/files/59673322224.pdf
http://www.rsvpcatering-ar.com/files/imagesfile/20119757099.pdf
http://elenasteele.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613164ce0ed32---vudulemijodotu.pdf
https://www.gullyracing.it/admin/ckfinder/userfiles/files/mafazitefokenuvinuvabaw.pdf
https://samirkumarpaul.com/ckfinder/userfiles/files/duvik.pdf
http://remproekt-m.ru/admin/ckfinder/userfiles/files/tameletupapanazakaw.pdf
http://uat.ideadunes.com/projects/ideadunes-portfolio-site/wp-content/plugins/formcraft/file-upload/server/content/files/16136f67c59d0c---17893674005.pdf
http://greenworx.eu/images/uploads/files/najofefadogulenimadavasez.pdf
http://boissee.fr/userfiles/file/bugafefopu.pdf
http://xingzhongjing.com/userfiles/file/20210908155053_1533550456.pdf
https://bedandbreakfastchia.it/userfiles/file/muzikokobixu.pdf
https://apoc.com.au/wp-content/plugins/super-forms/uploads/php/files/b14008d4c4dc10f417c2fee706aa2ff8/tigepibupuni.pdf
http://marymo.ru/uploads/files/kapujotiwenu.pdf
http://connect-event.fr/ckfinder/userfiles/files/laxojemilujetuteloxakuk.pdf
http://jshanwoo.com/ckfinder/userfiles/files/joputizel.pdf
http://automyjka.pl/automyjka.pl/userfiles/file/73438047578.pdf
http://naphogacomposite.com/upload/files/winevolegusejalubokuz.pdf
https://vinatech.com/userfiles/file/sivuzatukebajadavenak.pdf

Embedded domains

feedproxy.google.com
alajwakh.com
firmabudowlanawalczak.pl
xszhuhai.com
ikra-ekb.ru
fa-vietnam.com
mikomisushiwc.com
www.rsvpcatering-ar.com
elenasteele.com
www.gullyracing.it
samirkumarpaul.com
remproekt-m.ru
uat.ideadunes.com
greenworx.eu
boissee.fr
xingzhongjing.com
bedandbreakfastchia.it
apoc.com.au
marymo.ru
connect-event.fr
jshanwoo.com
automyjka.pl
naphogacomposite.com
vinatech.com
bodegoncriollo.com

Embedded IP addresses

20.165.94.46
20.42.179.192
4.150.223.115
57.155.101.212
20.42.65.90
52.110.12.55
52.110.12.14
4.230.171.124
74.178.240.61
135.233.95.135
52.123.128.14
52.123.252.229
203.26.79.13
52.123.252.202
74.178.76.44
142.251.42.99

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report