MALICIOUS — 5b12338e4ac988ab7884bf82a2a673ff59705ac0c14e850d39c8752dd91282d9

MALICIOUS — 5b12338e4ac988ab7884bf82a2a673ff59705ac0c14e850d39c8752dd91282d9 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 5b12338e4ac988ab7884bf82a2a673ff59705ac0c14e850d39c8752dd91282d9
SHA-1: 8158d7fa6641e4088d53d7b48f8cbe4ff185055f
MD5: 900b80dfa7c1e9e9c000fafe9b4ee910
ssdeep: 1536:nbv6RiftbKzqyofPMuxqNvXl7TpuKO0ghIJaWkxuv/6sWspO2NQuIJNhtJctJQFI:bkifw07xqNvX5NtOzhIJe8Sf2CuIJ3tG
TLSH: T19537AFE320A7DD5CB68AAF4739FA25A8604ADB8C6271ED505488F57CC0BC5BDBB10640
Submitted as: 5b12338e4ac988ab7884bf82a2a673ff59705ac0c14e850d39c8752dd91282d9
File type: pdf · Size: 74489 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://shieldtech.cz/ckfinder/userfiles/files/jobotof.pdf - network signal, weight 0.70, confidence 0.80
Contacted 18 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://penzionriverside.cz/files/file/devipiwom.pdf, https://shieldtech.cz/ckfinder/userfiles/files/jobotof.pdf, https://profitaler.com/UserFiles/file/81652130155.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9610 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
_dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787830249&P2=404&P3=2&P4=aVrRny9ZqlMb3AVemBVtHxbgq7olXuaXuhYVBbwX51lixsODL3wAjlpH37T2DiOeoW0%2f5DlLXXM0YfHxE2bJqg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787830311&P2=404&P3=2&P4=EjVZ1lzjGwVyGDBsibrx0JIHtB9X6aVBV9l8AQGtJEBjVeLUGaaLjQRpJdw9wcJUl7J%2bcU3nKHAFdN4t6kKW4A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 8495a7c98901f4acb2a77b5236d03060e8ad78070165367da8c0fb5c4a0c95f0
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\f72c30c6c2ec682f4da45e62c6ea71ab.png - fc4583386f11b7c4cb0e7ed6549462cba946f7338bea476c3cab4a3764103c58
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

http://feedproxy.google.com/~r/MbOu/~3/EqozwcbAC44/uplcv?utm_term=pencil+sketches+for+beginners+step+by+step
http://penzionriverside.cz/files/file/devipiwom.pdf
https://shieldtech.cz/ckfinder/userfiles/files/jobotof.pdf
https://profitaler.com/UserFiles/file/81652130155.pdf
http://archive-2015.humandoc.pl/attachments/file/21637796051.pdf
https://selectwifi.com/wp-content/plugins/formcraft/file-upload/server/content/files/16158aba4ef050---11036146400.pdf
https://newsru.md/upload/userfiles/files/6617098127.pdf
http://rivebistro.net/ckfinder/userfiles/files/88851741278.pdf
http://dirpub.org/editor/ckfinder/userfiles/files/kilipujeludavewetig.pdf
https://melz-feu.ru/upload/bovudujitem.pdf
http://aaas.handyfriendship.com/upload/files/jijewoxavosesosevo.pdf
http://discus-rus.ru/upl/file/32264159440.pdf
http://konsultacjenaukowe.eu/Upload/file/libuwiborus.pdf
http://stroyindustry.com/userfiles/file/40619612644.pdf
http://johndanton.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/pufosonew.pdf
http://www.alfapilates.pl/upload/file/tabolenixiseloma.pdf
https://refundsrefunds.com/wp-content/plugins/formcraft/file-upload/server/content/files/16159e08d0715a---bopetolerefumurivifoji.pdf
http://dossalas.com/wp-content/plugins/super-forms/uploads/php/files/47d244f2d1be8747d9a22b3388761e4c/50637071566.pdf
http://videlec.be/ressource/file/xuvekeziguwuk.pdf
http://reliancefla.com/admin/images/file/26518808514.pdf
http://cafesezony.ru/fck_editor_files/files/51735424551.pdf
http://kingbikeonline.com/images/upload/File/gasalopufipux.pdf
https://borgopitti.it/userfiles/file/33007597834.pdf
http://www.farmaciapenil.es/userfiles/files/wofiniviluteganoruk.pdf
https://promoform.coreform.it/uploads/file/xolaleri.pdf

Embedded domains

feedproxy.google.com
profitaler.com
archive-2015.humandoc.pl
selectwifi.com
rivebistro.net
dirpub.org
melz-feu.ru
aaas.handyfriendship.com
discus-rus.ru
konsultacjenaukowe.eu
stroyindustry.com
johndanton.com
www.alfapilates.pl
refundsrefunds.com
dossalas.com
videlec.be
reliancefla.com
cafesezony.ru
kingbikeonline.com
borgopitti.it
www.farmaciapenil.es
promoform.coreform.it
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

20.42.179.192
135.232.92.34
13.69.109.131
172.172.255.217
52.123.252.222
52.110.12.11
52.110.12.56
4.144.132.223
4.230.171.124
74.178.76.44
92.223.78.30
135.233.95.135
203.26.79.13
20.112.250.133
135.233.95.144
52.123.128.14
51.104.15.252
20.184.175.11

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report