MALICIOUS — pokemon-go-free-vs-pro_GM1094591345.pdf
MALICIOUS — pokemon-go-free-vs-pro_GM1094591345.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 3 of 53 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
5972735eae23c988e145f9b145a7cfdc2108fe191745eae1bb2a1f255d7f2aa2 - SHA-1:
18d6f94ae475f5046e0aa85fa63b0bc92a406850 - MD5:
c07be8aaeb14364ac103cd910cc486c3 - ssdeep:
3072:YXQcxEcG99tTtAlCQEXvsEdOQd6qumGLXW86J8m2J7sRYYQbVyusLa05jT4iubrd:RcxFo9PKCQKHdGEGLgwIaWjTfuF - TLSH:
T1D543F1F3918FCF0D76864B77ADE42116512CE205A1B2DFE515986B2CC4A827E2F11A33 - Submitted as: pokemon-go-free-vs-pro_GM1094591345.pdf
- File type: pdf · Size: 232596 bytes
- Verdict: malicious (75/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: Trojan:PDF/Phish.CFN!MTB
- Emsisoft (Emergency Kit): PDF.Spam.Heur.2
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 7 weighted signals:
- Contacted 18 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded link rated suspicious by URL analysis: http://www.ck-ceramic.com/Public/upload/editorfiles/minecraft-java-hacks_GM479516143.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: http://netcdn.tw/app/1094591345/pokemon-go-free-vs-pro-game-hack, http://www.ck-ceramic.com/Public/upload/editorfiles/minecraft-java-hacks_GM479516143.pdf, http://www.ck-ceramic.com/Public/upload/editorfiles/immediate-free-robux_GM431946152.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
9795 behavior events · 1 ATT&CK techniques · 3 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- desktop-hsgcbep
- ntp.ubuntu.com
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 79.243.254.169.in-addr.arpa
- 252.0.0.224.in-addr.arpa
- 255.255.254.169.in-addr.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
Dropped files
- C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\17a5ee0e9c1509e921191f31339a3d6e.png -
af4f024ce8a801f8e29b0647aa6d50efdb6aba38b4a4de34516827c9630ce140 - C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt -
1df5bf0b452c53df2c873a4604f71da75fb97583531bd6357b34ae28e60612d0 - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- http://netcdn.tw/app/1094591345/pokemon-go-free-vs-pro-game-hack
- http://www.ck-ceramic.com/Public/upload/editorfiles/minecraft-java-hacks_GM479516143.pdf
- http://www.ck-ceramic.com/Public/upload/editorfiles/immediate-free-robux_GM431946152.pdf
- http://www.ck-ceramic.com/Public/upload/editorfiles/100-free-spins-on-coin-master_GM406889139.pdf
- http://www.ck-ceramic.com/Public/upload/editorfiles/free-tiktok-likes-no-verification_GM835599320.pdf
- http://www.ck-ceramic.com/Public/upload/editorfiles/coin-master-rewards-app_GM406889139.pdf
- http://www.ck-ceramic.com/Public/upload/editorfiles/roblox-hack-client_GM431946152.pdf
- http://www.ck-ceramic.com/Public/upload/editorfiles/minecraft-java-free-account_GM479516143.pdf
- http://www.ck-ceramic.com/Public/upload/editorfiles/roblox-weight-lifting-simulator-3-infinite-strength-hack-script_GM431946152.pdf
- http://www.ck-ceramic.com/Public/upload/editorfiles/free-minecraft-capes-no-mods_GM479516143.pdf
- http://www.ck-ceramic.com/Public/upload/editorfiles/can-you-really-hack-coin-master_GM406889139.pdf
- http://www.ck-ceramic.com/Public/upload/editorfiles/coin-master-cheats-and-hacks_GM406889139.pdf
- http://www.ck-ceramic.com/Public/upload/editorfiles/coin-master-spin-link-free_GM406889139.pdf
- http://www.ck-ceramic.com/Public/upload/editorfiles/100-free-spins-for-coin-master_GM406889139.pdf
- http://www.ck-ceramic.com/Public/upload/editorfiles/coin-master-hack-apk-app_GM406889139.pdf
- http://www.ck-ceramic.com/Public/upload/editorfiles/minecraft-free-unblocked_GM479516143.pdf
- http://www.ck-ceramic.com/Public/upload/editorfiles/como-hackear-cuentas-de-roblox-facil-y-rapido_GM431946152.pdf
- http://www.ck-ceramic.com/Public/upload/editorfiles/free-robux-scam_GM431946152.pdf
- http://www.ck-ceramic.com/Public/upload/editorfiles/coin-master-daily-free-rewards_GM406889139.pdf
- http://www.ck-ceramic.com/Public/upload/editorfiles/how-to-get-free-robux-no-hack-2021_GM431946152.pdf
- http://www.ck-ceramic.com/Public/upload/editorfiles/free-robux-without-survey_GM431946152.pdf
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
Embedded domains
- netcdn.tw
- www.ck-ceramic.com
Embedded IP addresses
- 20.42.65.90
- 52.123.128.14
- 85.210.196.11
- 20.184.175.4
- 184.84.165.136
- 4.230.171.124
- 40.84.97.4
- 52.230.60.54
- 135.232.92.137
- 52.178.17.234
- 52.182.143.212
- 52.123.129.14
- 203.26.79.13
- 20.165.94.46
- 172.175.111.170
- 4.150.223.111
- 20.50.80.215
- 20.184.175.20
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report