MALICIOUS — 5bf1f65bbbbfe50d8e5eefc1e32bfdf33f0c685429fa62aed1f7de7009643d1d
MALICIOUS — 5bf1f65bbbbfe50d8e5eefc1e32bfdf33f0c685429fa62aed1f7de7009643d1d is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 54 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
5bf1f65bbbbfe50d8e5eefc1e32bfdf33f0c685429fa62aed1f7de7009643d1d - SHA-1:
3b3ca0e86d5b63dccd5e748e5bf7d4947ed4f6ba - MD5:
8839dd15332c001c06e3b280205b897c - ssdeep:
1536:gpbYD02TJPBA/IYxiGmGq3iH4PVYbishGofAWH+qgH8fbB/aZWfcUQWwpOSCs/:82N5A/DdKVYbdmt8fb52ocUfSJ - TLSH:
T1BA38C0F3616BDD0C7B8F8B0366EB147CA48DD6849661EB54408CF76C84BC67DAE01A60 - Submitted as: 5bf1f65bbbbfe50d8e5eefc1e32bfdf33f0c685429fa62aed1f7de7009643d1d
- File type: pdf · Size: 82925 bytes
- Verdict: malicious (99/100)
Detections (4 of 54 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 10 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule
HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85 - Contacted 13 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded link rated suspicious by URL analysis: http://savitaco.com/uploads/images/files/43509968459.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://queure.ru/uplcv?utm_term=oracle+pdf+import+extension+download, http://savitaco.com/uploads/images/files/43509968459.pdf, https://imad0c0.com/js/ckfinder/userfiles/files/82474412383.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
1009 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ntp.ubuntu.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://c.pki.goog/r/r1.crl
- http://x2.c.lencr.org/
- http://ye.c.lencr.org/
- http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
- http://yr.c.lencr.org/
- 23.40.52.85
- 23.11.37.157
- 172.66.2.5 US · San Francisco · AS13335 Cloudflare, Inc.
Dropped files
- root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://queure.ru/uplcv?utm_term=oracle+pdf+import+extension+download
- http://savitaco.com/uploads/images/files/43509968459.pdf
- https://imad0c0.com/js/ckfinder/userfiles/files/82474412383.pdf
- http://www.saraviation.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613ea4c2532a3---silul.pdf
- http://bilagroup.com/wp-content/plugins/formcraft/file-upload/server/content/files/161324dc676bf5---45583154670.pdf
- http://fvv-hohenfelde.de/sites/default/files/files/25870798377.pdf
- https://www.jemelectric.com/wp-content/plugins/formcraft/file-upload/server/content/files/1615978e6f2fc6---28235233558.pdf
- http://zezoalza.com/ckupload/files/sosofekedaladivikofu.pdf
- http://kapalishakti.com/ckfinder/userfiles/files/80674798254.pdf
- http://klpa.net/userData/board/file/27105958003.pdf
- http://cmrivestimenti.com/userfiles/files/79114708244.pdf
- http://casavacanzesanvito.eu/userfiles/files/zuvux.pdf
- https://bywuf.org/upload/editor/files/guzela.pdf
- http://crystalnymph.by/wp-content/plugins/super-forms/uploads/php/files/b038f2efbaafe134497deb956d38cb43/91675915277.pdf
- http://lamexmarket.com/uploads/files/panuk.pdf
- http://www.ecostroyservis.ru/File/fapedeka.pdf
- http://www.ponderosafestival.com/wp-content/plugins/formcraft/file-upload/server/content/files/16144ddb962ee0---mefekiletew.pdf
- http://aeusjtu.pretty-match.com/upload/files/magaxawibojazorapanixevam.pdf
- https://cutletsmeat.com/wp-content/plugins/formcraft/file-upload/server/content/files/16137e2ec55ed0---49125531182.pdf
- http://suamayin.biz/userfiles/file/fupigibidenixe.pdf
- https://5uempat.com/contents/files/12511063124.pdf
- https://fitnessrev.net/wp-content/plugins/super-forms/uploads/php/files/3gr9hg43er584rn5bso4ot6nsb/xuritosoxobidi.pdf
- https://www.chablis-gautherin.com/ckfinder/userfiles/files/15479466270.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- queure.ru
- savitaco.com
- imad0c0.com
- www.saraviation.com
- bilagroup.com
- fvv-hohenfelde.de
- www.jemelectric.com
- zezoalza.com
- kapalishakti.com
- klpa.net
- cmrivestimenti.com
- casavacanzesanvito.eu
- bywuf.org
- lamexmarket.com
- www.ecostroyservis.ru
- www.ponderosafestival.com
- aeusjtu.pretty-match.com
- cutletsmeat.com
- suamayin.biz
- 5uempat.com
- fitnessrev.net
- www.chablis-gautherin.com
- www.w3.org
- purl.org
- ns.adobe.com
Embedded IP addresses
- 52.178.17.2
- 57.155.101.212
- 172.172.255.217
- 20.184.175.5
- 13.89.179.12
- 57.154.63.210
- 20.42.65.85
- 172.66.2.5
- 52.123.252.229
- 4.230.171.124
- 20.42.179.204
- 20.165.94.54
- 135.232.92.137
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report