MALICIOUS — 58ae3892c9565820a111ffbf292033e8ae3d72b9b78edbd1f1353ec87d1ec127

MALICIOUS — 58ae3892c9565820a111ffbf292033e8ae3d72b9b78edbd1f1353ec87d1ec127 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 58ae3892c9565820a111ffbf292033e8ae3d72b9b78edbd1f1353ec87d1ec127
SHA-1: 72a5d3be5eeeb6c07df769d6ad71e5376219da29
MD5: 08de04c994e3a71bf4e25680749ebda3
ssdeep: 1536:Gq6kEqRCUJMm9ytFRb8/C75ucfWm0XswONYYfVHn3kGqHjhW6zq1r:16kExKMmy7Rb8675ucfD0XswONYYf93L
TLSH: T1D738D0F3219FCD5CAA879B4359E9242C345ED788363AE7A840C87B6CC5B837C6D14920
Submitted as: 58ae3892c9565820a111ffbf292033e8ae3d72b9b78edbd1f1353ec87d1ec127
File type: pdf · Size: 79037 bytes
Verdict: malicious (96/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!08DE04C994E3
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 18 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://topopentertainment.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a7beac0384e---16767130403.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://smidgel.ru/uplcv?utm_term=free+slots+casino+mod+apk, http://www.nanodrywash.com/wp-content/plugins/formcraft/file-upload/server/content/files/16084b989ab762---61511054459.pdf, http://www.barankayalar.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/160a211b2e6c63---56233858943.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (17 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9755 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787831485&P2=404&P3=2&P4=Zn2TDfTnN9UOV3v5%2f%2fHql2Zqiupn%2fXF5hvlyT3EyxeJfwU%2bJZKe2Fp8fCfUj88RcE7oZyt5j7%2f7PymuNeLGO6Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787831506&P2=404&P3=2&P4=Gknd1nPwgh4gbdR1YDiE3HeDIGWH5xk4Ghswk8lwECkixU3En1MNxlL5ylMUOYd36539Em6kYxkwGvBpDG247A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\7afed0bc070125181e3bf9ac75826671.png - 40c294a78783598d38a5d64bc199d0b3e4851485d312ad8d217f44696396cb78
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - bea6ee8bd2f4a3fd4ae969b601a47e33cdeb4de290b6cad98dd16218a3a0b67f
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://smidgel.ru/uplcv?utm_term=free+slots+casino+mod+apk
http://www.nanodrywash.com/wp-content/plugins/formcraft/file-upload/server/content/files/16084b989ab762---61511054459.pdf
http://www.barankayalar.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/160a211b2e6c63---56233858943.pdf
https://earthchartercities.org/wp-content/plugins/formcraft/file-upload/server/content/files/16094cb37c49be---xuvinolesamalonov.pdf
https://mandalaconfeccao.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160b50daf15d70---gagalugazazivoto.pdf
https://jollytime.ru/wp-content/plugins/super-forms/uploads/php/files/3195a09465aa2b9a8ce2a2ed444d3bea/duvazakibojefibozefepebi.pdf
https://sportli.co.il/wp-content/plugins/formcraft/file-upload/server/content/files/1608dde88a3cbf---20394726397.pdf
http://totalfinance.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1608219dad1ebd---jizofozimuvokesiwuzexafif.pdf
https://heykidsletscook.info/wp-content/plugins/super-forms/uploads/php/files/1cd4479ec9aab23c94c81facab7a6615/45468167139.pdf
http://topopentertainment.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a7beac0384e---16767130403.pdf
http://taeguektour.com/FileData/ckfinder/files/20210528_E7F859B9531E4041.pdf
http://musclecar-taps.com/js/upload/files/nokuxixobisepid.pdf
http://www.tsssport.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a586f504a4e---76053826010.pdf
http://webbuilders.com/files/file/49566068429.pdf
http://lbs.ac.at/wp-content/plugins/super-forms/uploads/php/files/1kust3jboijo32ei2tcad1okpt/vewefat.pdf
https://movesforfree.com/wp-content/plugins/super-forms/uploads/php/files/aksmb08474lqc0meds4da3u5b2/75864374109.pdf
https://costumeworld.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083e9ad0b8a4---88212406609.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Embedded domains

smidgel.ru
www.nanodrywash.com
earthchartercities.org
mandalaconfeccao.com.br
jollytime.ru
totalfinance.ca
heykidsletscook.info
topopentertainment.com
taeguektour.com
musclecar-taps.com
www.tsssport.com
webbuilders.com
movesforfree.com
costumeworld.com
www.w3.org
purl.org
ns.adobe.com
www.barankayalar.com.tr
sportli.co.il
lbs.ac.at

Embedded IP addresses

4.150.223.115
52.168.117.171
172.215.188.232
52.123.252.246
52.110.12.46
4.230.171.124
20.165.94.54
20.76.201.171
74.179.77.204
52.123.129.14
52.123.252.230
72.145.35.110
203.26.79.13
52.123.252.245
4.209.250.170
40.79.163.154
4.150.223.100
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report