MALICIOUS — 4ed13c70fc509473b5ea4e56e38e7e55e577c7939a40947531b2a81dc5e462e2

MALICIOUS — 4ed13c70fc509473b5ea4e56e38e7e55e577c7939a40947531b2a81dc5e462e2 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100). 5 of 54 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 4ed13c70fc509473b5ea4e56e38e7e55e577c7939a40947531b2a81dc5e462e2
• SHA-1: 6f3a5e90f554f4cbf27a995875b816d2d0ba02c5
• MD5: 3d7ddf9ce4920b5b9b651743a324a485
• ssdeep: 1536:wHb3bSFPbdRGE70RuMCsG+8tWo6aHi9xx28fQACCNVBvdcKWGlpNtwEWLE:Ub3ORbKE0RuIG+8tzxizxT4aNVB0Glp7
• TLSH: T14E37E0F361ABDD8C6E8B5B036EEB296D5082D7883172C6505148BBBCD4BCB7D5E60840
• Submitted as: 4ed13c70fc509473b5ea4e56e38e7e55e577c7939a40947531b2a81dc5e462e2
• File type: pdf · Size: 76357 bytes
• Verdict: malicious (100/100)

Detections (5 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!3D7DDF9CE492
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1105
• T1566.002

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged PDF/Phish-FAB!3D7DDF9CE492 (rule PDF/Phish-FAB!3D7DDF9CE492) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
• Contacted 8 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded link rated suspicious by URL analysis: http://stylist.in.ua/wp-content/plugins/formcraft/file-upload/server/content/files/1606f1914bb5ce---rawawifiwatenijijawizot.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://coretry.ru/uplcv?utm_term=vocaloid+5+free+download, https://www.lightingsolutionsinc.net/wp-content/plugins/super-forms/uploads/php/files/9a43756ef89965bf69c47f4f2fd07c71/jobot.pdf, http://redwoodpwr.com/wp-content/plugins/super-forms/uploads/php/files/oihdlqnk1ndhmk6ql9dd0t8n64/2388181517.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

942 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• desktop-hsgcbep._dosvc._tcp.local
• desktop-hsgcbep(1)._dosvc._tcp.local
• _dosvc._tcp.local
• ntp.ubuntu.com
• desktop-hsgcbep(2)._dosvc._tcp.local
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl

Dropped files

• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://coretry.ru/uplcv?utm_term=vocaloid+5+free+download
• https://www.lightingsolutionsinc.net/wp-content/plugins/super-forms/uploads/php/files/9a43756ef89965bf69c47f4f2fd07c71/jobot.pdf
• http://redwoodpwr.com/wp-content/plugins/super-forms/uploads/php/files/oihdlqnk1ndhmk6ql9dd0t8n64/2388181517.pdf
• https://olmitek.by/wp-content/plugins/super-forms/uploads/php/files/bodkplnu6o24uqrl2vc3388b33/ponidifuwosave.pdf
• http://www.expo-hotel.com/english/wp-content/plugins/formcraft/file-upload/server/content/files/160b30e9ab0cae---79303229717.pdf
• http://stylist.in.ua/wp-content/plugins/formcraft/file-upload/server/content/files/1606f1914bb5ce---rawawifiwatenijijawizot.pdf
• https://cleaner.pl/userfiles/file/likidusejukuli.pdf
• https://ipcare.nl/wp-content/plugins/super-forms/uploads/php/files/0ed1fmcq726jhkcqbacm26isca/gesevix.pdf
• http://rethabise.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160c01f8266ee2---xomawapoxuxujoxevemokit.pdf
• http://saovietgroup.com/upload/FCK/file/95981270990.pdf
• https://www.hotel-palladium.gr/wp-content/plugins/super-forms/uploads/php/files/j518r7rh0lr2odu64e807s9adr/39256880331.pdf
• https://primeodontorj.com/wp-content/plugins/super-forms/uploads/php/files/a0ad75ce669c5a7141137b4fa9131dc8/ralemefukopetiseronena.pdf
• http://copy2d.com/ftp/image/file/75956252142.pdf
• https://ajitcoatings.com/uploads/83010190094.pdf
• http://firegallery.ru/img/upload/5149944822.pdf
• https://mercedesmazo.es/wp-content/plugins/formcraft/file-upload/server/content/files/160bb6c5853905---58725788613.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• coretry.ru
• www.lightingsolutionsinc.net
• redwoodpwr.com
• www.expo-hotel.com
• stylist.in.ua
• cleaner.pl
• ipcare.nl
• rethabise.co.za
• saovietgroup.com
• primeodontorj.com
• copy2d.com
• ajitcoatings.com
• firegallery.ru
• mercedesmazo.es
• www.w3.org
• purl.org
• ns.adobe.com
• olmitek.by
• www.hotel-palladium.gr
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 172.215.188.225
• 52.110.12.4
• 4.230.171.124
• 104.18.33.89
• 20.165.94.54
• 52.230.60.54
• 135.232.92.137
• 20.42.65.90

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report