MALICIOUS — 58eb61a1092238543b5b81844a071673226b875f5cc1788095bd3119dc58a970

MALICIOUS — 58eb61a1092238543b5b81844a071673226b875f5cc1788095bd3119dc58a970 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 58eb61a1092238543b5b81844a071673226b875f5cc1788095bd3119dc58a970
SHA-1: 54857f712b5b49ba82753521d1a679afecc91fdb
MD5: c22f8cdb85aa2a9176b7bcc7e7b992c7
ssdeep: 1536:wphrF1F+DUqh9fiwUmWrnpF9nW7y9X9E3ENjPHwmxt/B5ymOykkaWxApOGzWe1BZ:6rYpn14rD98SjPQChaikkf3G9BZliR+9
TLSH: T1BB39D0F321DBDC5CB78ECB4765AB205CB08AE7CC3562EA9080987A6C907C6BDBD10511
Submitted as: 58eb61a1092238543b5b81844a071673226b875f5cc1788095bd3119dc58a970
File type: pdf · Size: 87280 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 16 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://bige.vn/uploads/userfiles/file/judaline.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: http://bige.vn/uploads/userfiles/file/judaline.pdf, http://novichiha.ru/pic/file/62252157108.pdf, https://www.clinicaepilepsia.cl/ckfinder/userfiles/files/39946452805.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9681 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
_dosvc._tcp.local
desktop-hsgcbep._dosvc._tcp.local
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\c1941fc71005e4ac4e054817a503d736.png - be444196684a89bbd6f2a8cb95b0b3fb8f6d940625454eb34b5ea43811e5a33c
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 1608f9ab4bc2857789054833781eaf44d605592a59409213d89d8f79b18b6cd9
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/1xuhb7AK25c/uplcv?utm_term=what+season+do+you+harvest+corn
http://bige.vn/uploads/userfiles/file/judaline.pdf
http://novichiha.ru/pic/file/62252157108.pdf
https://www.clinicaepilepsia.cl/ckfinder/userfiles/files/39946452805.pdf
https://rotitelor.com/contents/files/97736840463.pdf
http://www.pics4us.de/userfiles/file/45784800622.pdf
http://bensonlandscape.com/editorData/file/nasalowevarinotokuru.pdf
https://hn-as.dk/sites/default/files/userfiles/file/23904396700.pdf
https://414movement.com/wp-content/plugins/super-forms/uploads/php/files/c880a28b6bb8f77f13ce35f14de46201/4331884169.pdf
http://tanabuauto.com/js/upload/files/39386195539.pdf
https://drahmetbostanci.com/wp-content/plugins/formcraft/file-upload/server/content/files/16153b09c5389b---19691689956.pdf
https://baoholaodong24.com/userfiles/file/majomulimuxujof.pdf
http://smartmedicaleg.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613ac6cf784b3---koluvenegexe.pdf
http://seoulmenu.com/uploads/files/fadojuvuzepuvepijolerunit.pdf
https://pu-sk.com/app/templates/js/ckfinder/userfiles/files/pebesojomef.pdf
http://www.thebetterinsurance.com/wp-content/plugins/formcraft/file-upload/server/content/files/1615b80173680f---94171960837.pdf
http://tetobox-budapest.hu/uploads/files/mevajaze.pdf
https://ghnservizi.com/file/23737492345.pdf
https://datenglagi.com/contents/files/vosogosu.pdf
http://suncitygroup.ir/basefile/suncitygroupir/files/fizesirarimon.pdf
http://flixgolf.com/ckeditor/ckfinder/userfiles/files/kanowixolomenodejuwigeva.pdf
https://gulertrafik.com/wp-content/plugins/super-forms/uploads/php/files/iri2ac5sb58ils93g5b4ih4snm/xofalerusipuwat.pdf
https://takarasushimn.com/userfiles/files/48578400991.pdf
http://chistogood.ru/admin/ckfinder/userfiles/files/17209671638.pdf
https://akamercedes.com/images/uploads/files/96417360117.pdf

Embedded domains

feedproxy.google.com
novichiha.ru
rotitelor.com
www.pics4us.de
bensonlandscape.com
414movement.com
tanabuauto.com
drahmetbostanci.com
baoholaodong24.com
smartmedicaleg.com
seoulmenu.com
pu-sk.com
www.thebetterinsurance.com
ghnservizi.com
datenglagi.com
suncitygroup.ir
flixgolf.com
gulertrafik.com
takarasushimn.com
chistogood.ru
akamercedes.com
israelonthehouse.com
ibexquimica.com.br
www.w3.org
purl.org

Embedded IP addresses

51.116.246.106
52.123.252.236
172.66.2.5
135.232.92.34
52.110.12.28
4.230.171.124
125.56.205.105
52.230.59.222
203.26.79.13
74.178.240.51
74.178.76.128
20.89.1.10
20.42.179.204
172.175.111.170
4.150.223.103
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report