MALICIOUS — 5e6de7c2f8dc6c5b61335c7331003826cc2a2da7ee4085c7ff36267a4a86830b

MALICIOUS — 5e6de7c2f8dc6c5b61335c7331003826cc2a2da7ee4085c7ff36267a4a86830b is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 5e6de7c2f8dc6c5b61335c7331003826cc2a2da7ee4085c7ff36267a4a86830b
• SHA-1: a15a141e5a5373c119208f8e991c318e661389cd
• MD5: e89f9b600512a874ab021a74e0881b4d
• ssdeep: 1536:WmiGt4LqpKnljKwaPXEH389dxhbw5C6lHYA/5DXFK9LIds:LizLCKpX8/A5EA/5DXFyLX
• TLSH: T1FA38D0F7A247DD8CB75B8743ADAA05286145C2896233E7408458F76CD8BC7BE7F21A40
• Submitted as: 5e6de7c2f8dc6c5b61335c7331003826cc2a2da7ee4085c7ff36267a4a86830b
• File type: pdf · Size: 76789 bytes
• Verdict: malicious (96/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!E89F9B600512
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1105
• T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Contacted 14 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
• Embedded link rated suspicious by URL analysis: http://beckydavidsonhomes.com/wp-content/plugins/formcraft/file-upload/server/content/files/160917b7134d81---wapazu.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: http://maxitelt.no/wp-content/plugins/formcraft/file-upload/server/content/files/1607a5ed91d7af---81264507490.pdf, https://personalloan2u.com/wp-content/plugins/super-forms/uploads/php/files/469159d33ca3da88b68960ec244f6e52/67636421366.pdf, https://40parables.com/wp-content/plugins/super-forms/uploads/php/files/52a302d7ec4013ace59926b303de93b2/41095199575.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9773 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• desktop-hsgcbep._dosvc._tcp.local
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 250.255.255.239.in-addr.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• ntp.ubuntu.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Dropped files

• C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 48535d3bcc89677c276c6e3ca90e7212057815158c8940023dec8035427c0bb7
• C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\8267c7cf128f3dc0f27705a4652c45a0.png - 49ad618ab09e8c83f6ef06b9f96cbe042153f6f1a56dfc0ba1d6cb9c947f4525
• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/PmAiG5ZyT-k/uplcv?utm_term=alphanumeric+series+reasoning+questions+pdf
• http://maxitelt.no/wp-content/plugins/formcraft/file-upload/server/content/files/1607a5ed91d7af---81264507490.pdf
• https://personalloan2u.com/wp-content/plugins/super-forms/uploads/php/files/469159d33ca3da88b68960ec244f6e52/67636421366.pdf
• https://40parables.com/wp-content/plugins/super-forms/uploads/php/files/52a302d7ec4013ace59926b303de93b2/41095199575.pdf
• https://www.quatainvestimentos.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16072e429dd475---bixanesozanafex.pdf
• http://bamt.be/wp-content/plugins/formcraft/file-upload/server/content/files/1608466c7e2fa9---60275412551.pdf
• http://beckydavidsonhomes.com/wp-content/plugins/formcraft/file-upload/server/content/files/160917b7134d81---wapazu.pdf
• http://www.opencalgary.org/wp-content/plugins/formcraft/file-upload/server/content/files/1608f6f080112a---xuzozujavex.pdf
• http://cohn-vossen.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608d3884d2a67---61214902662.pdf
• http://www.belladermeestetica.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1607a40194fc7f---71821913635.pdf
• https://agsposure.org/wp-content/plugins/super-forms/uploads/php/files/d01065bd7ee922b66d6e386d8ece86b2/genuvuvojuxiperowewumog.pdf
• http://sakirnoopo.ru/wp-content/plugins/super-forms/uploads/php/files/3903159a66610d122d8a044eb31c16c3/71894000515.pdf
• https://www.scanworld.se/wp-content/plugins/formcraft/file-upload/server/content/files/1608706c7bf332---6093021383.pdf
• http://call.ae/wp-content/plugins/formcraft/file-upload/server/content/files/1607e19d190ccd---lenil.pdf
• https://sip7.pl/autoinstalator/sip7.online/wp-content/plugins/super-forms/uploads/php/files/45749aefcd6e5d2ea941375ad5986c74/pufuvavoped.pdf
• http://www.skup.it/wp-content/plugins/formcraft/file-upload/server/content/files/16093b8567db62---41513764748.pdf
• http://www.idenet.net/wp-content/plugins/formcraft/file-upload/server/content/files/160792a5b86084---2500597546.pdf
• http://www.iamgoingto1996.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ca33b3870e---zowoduwabivibezisuvimefu.pdf
• https://mindweave.co.uk/wp-content/plugins/super-forms/uploads/php/files/r80u31bg72eiokq7f4rlmr0el9/56850213302.pdf
• https://www.asahinadigital.com/wp-content/plugins/super-forms/uploads/php/files/1uj2q10urlsunt165ovkdgtsnh/tarewakijasaxagigagepulit.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/

Embedded domains

• feedproxy.google.com
• maxitelt.no
• personalloan2u.com
• 40parables.com
• www.quatainvestimentos.com.br
• bamt.be
• beckydavidsonhomes.com
• www.opencalgary.org
• cohn-vossen.com
• www.belladermeestetica.com.br
• agsposure.org
• sakirnoopo.ru
• www.scanworld.se
• sip7.pl
• sip7.online
• www.skup.it
• www.idenet.net
• www.iamgoingto1996.com
• mindweave.co.uk
• www.asahinadigital.com
• www.w3.org
• purl.org
• ns.adobe.com
• call.ae

Embedded IP addresses

• 203.26.79.13
• 52.110.12.47
• 52.110.12.4
• 4.230.171.124
• 4.144.132.223
• 135.232.92.137
• 4.150.223.97
• 74.179.77.204
• 52.123.128.14
• 172.178.240.162
• 40.79.167.10
• 4.150.223.99
• 48.200.63.27
• 20.42.179.192

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report