MALICIOUS — 54c2d0e9236d8189c2fef1d40d98a392631fd663c8217482238492f3dcd1b200

MALICIOUS — 54c2d0e9236d8189c2fef1d40d98a392631fd663c8217482238492f3dcd1b200 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 54c2d0e9236d8189c2fef1d40d98a392631fd663c8217482238492f3dcd1b200
SHA-1: 19218c2c5b45c1f7f7c732bf0ad8bec560e17b76
MD5: 9f42bbc775a08392f2c329773e787b45
ssdeep: 1536:5KQb9AXgJFzRgxPVwTGhVx3zLbP9eB+LDBA9Wo8Jrs3WQpOCwD+:5SXgJZR0twUVx379k+ucsiC/
TLSH: T13537C0F310D7DE5CBB879B436D77119CA54AD7857171EA9000887E6C947C9BDBA20B00
Submitted as: 54c2d0e9236d8189c2fef1d40d98a392631fd663c8217482238492f3dcd1b200
File type: pdf · Size: 71202 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 19 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://xn--ob0bjxt9h99icicrvkksa421cwwp7hiv4d6a.com/ckfinder/userfiles/files/42784320866.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://cructi.ru/uplcv?utm_term=tekken+3+apk+download+45+mb, https://proektasis.gr/admin/spaw2/uploads/files/40153237200.pdf, http://musclecar-taps.com/js/upload/files/45925360177.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9584 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787813776&P2=404&P3=2&P4=MGW2cRx2OsQGv7conGn4DoggIS4NMX%2bhJuemy7mu9jERQkIhUhwpxEh4kNndQEgT8VkY5ZHRFyH9IwDGdPWVFg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787813821&P2=404&P3=2&P4=QFF6ukfOiupoxf7gxZ5z2M5RWyTKo3XVnaWHLi%2fsfIVEiwDU43kPfuGWQNTUmwNNw1ZUzPmve2d9QNcm76yjUg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
23.40.52.209
23.11.37.157

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\56b000e369b80264676a2d4cd000537b.png - e568661f1238ec58f74bf7ac513c14d440e8679beb74a7d81df4dffac74bee72
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 18961324345cec8cb358b3a7489d0437d7e2463a4c885047d77e20a20c5b47ff
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://cructi.ru/uplcv?utm_term=tekken+3+apk+download+45+mb
https://proektasis.gr/admin/spaw2/uploads/files/40153237200.pdf
http://musclecar-taps.com/js/upload/files/45925360177.pdf
https://admonks.ru/wp-content/plugins/super-forms/uploads/php/files/32aaf25a4f25e023e442a920faed15e7/82181746385.pdf
https://angelsforwarriors.org/userfiles/files/fuzajufuv.pdf
https://www.indee-r.fr/wp-content/plugins/super-forms/uploads/php/files/e7adc6319325a2541007aa0034d1c470/buzamenitemojedimedetu.pdf
http://sahcarpets.com/userfiles/file/91174508233.pdf
https://taechoclub.com/FileData/ckfinder/files/20210909_100DF90F03D18205.pdf
http://xn--ob0bjxt9h99icicrvkksa421cwwp7hiv4d6a.com/ckfinder/userfiles/files/42784320866.pdf
http://anonelectronics.com/admin/fckeditor/editor/filemanager/connectors/php/upload_jpg/file/202109170043223445.pdf
http://mitcostruttori.it/userfiles/files/wanumabejixonelu.pdf
http://aeskulap24h.de/wp-content/plugins/formcraft/file-upload/server/content/files/1613fe8c9059f0---32913887463.pdf
https://ubranni.com/uploader/files/xogamapojo.pdf
http://tycoonmedical.com/userfiles/file/mosalalitodefugawini.pdf
http://csc0535.com/userfiles/file/20210928014457_vnw7uf.pdf
https://eurochen.com/UpFiles/WebEditorFiles/file/lojuxuf.pdf
http://thietbimaugiao.vn/Images_upload/files/gejuxejuzatos.pdf
http://grafitym.kz/files/file/83039690275.pdf
https://evabizz.com/userfiles/file/1020252304.pdf
https://ver9.sonikgps.com/ckfinder/userfiles/files/sujifabewot.pdf
https://njsolarpower.com/wp-content/plugins/super-forms/uploads/php/files/56b03ee27b5f4359d94895bb88cea274/75515103339.pdf
http://sanraimundo.cl/dyn/uploads/file/tagimipazupobawujakuvutep.pdf
http://www.tamtrebinhminh.com/public/files/pegarisisudopimaxi.pdf
http://baocaosuhoatoc.com/luutru/files/35801088071.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

cructi.ru
musclecar-taps.com
admonks.ru
angelsforwarriors.org
www.indee-r.fr
sahcarpets.com
taechoclub.com
xn--ob0bjxt9h99icicrvkksa421cwwp7hiv4d6a.com
anonelectronics.com
mitcostruttori.it
aeskulap24h.de
ubranni.com
tycoonmedical.com
csc0535.com
eurochen.com
evabizz.com
ver9.sonikgps.com
njsolarpower.com
www.tamtrebinhminh.com
baocaosuhoatoc.com
www.w3.org
purl.org
ns.adobe.com
proektasis.gr
thietbimaugiao.vn

Embedded IP addresses

20.165.94.46
57.155.101.212
4.150.223.98
125.56.205.32
52.110.12.54
4.230.171.124
125.56.205.25
20.247.185.124
135.233.95.135
74.178.76.128
52.123.129.14
40.104.4.2
20.42.65.93
72.153.5.61
203.26.79.13
92.223.78.30
20.42.65.85
48.211.4.16
172.175.111.170

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report