MALICIOUS — 5e780091fdc7cedc2cc2e78a15d6d018d0ba87c428f6ac8e3a7d2f2ccacad98c

MALICIOUS — 5e780091fdc7cedc2cc2e78a15d6d018d0ba87c428f6ac8e3a7d2f2ccacad98c is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 5e780091fdc7cedc2cc2e78a15d6d018d0ba87c428f6ac8e3a7d2f2ccacad98c
SHA-1: a0fa4f6ecb6fe9d150793db7790d7b8ddb1e5f3b
MD5: 0750737425ac41282ac4baf5f0773b5d
ssdeep: 1536:YDckNpF+gmHrndxMT08PBK5MltsEeWapOtQHWB0tGJb5HYlMFQ:KlgLndm08PBvCEjtQOZJb5Q5
TLSH: T1D639D0F371A7ED4C764B970329A71369608AD3C86172DBA04188BB1C987C6BE7F04981
Submitted as: 5e780091fdc7cedc2cc2e78a15d6d018d0ba87c428f6ac8e3a7d2f2ccacad98c
File type: pdf · Size: 84552 bytes
Verdict: malicious (98/100)

Detections (4 of 54 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 98/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://linhkienhunganh.vn/luutru/files/jonezoxetajipabi.pdf, https://christembassybarking.org/wp-content/plugins/super-forms/uploads/php/files/4c1f6ff774b6c56ed9416845a7dc39f9/jufoxorum.pdf, http://grafosaleservice.cz/images/fck_editor/file/fabakimo.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Contacted 9 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

1227 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
ntp.ubuntu.com
desktop-hsgcbep
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
23.40.52.209
23.11.37.157
20.190.167.20
52.123.252.248 AU · Sydney · AS8075 Microsoft Corporation
52.110.12.46 AU · Sydney · AS8075 Microsoft Corporation
52.110.12.21 AU · Sydney · AS8075 Microsoft Corporation
4.230.171.124 KR · Seoul · AS8075 Microsoft Corporation
23.33.238.102
57.154.63.210 US · Phoenix · AS8075 Microsoft Limited UK
52.168.117.168 US · Chantilly · AS8075 Microsoft Corporation
150.171.28.11

Dropped files

root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/skout/mBVl/~3/fzgW7-mxBc0/uplcv?utm_term=cross+validation+for+logistic+regression
http://linhkienhunganh.vn/luutru/files/jonezoxetajipabi.pdf
https://christembassybarking.org/wp-content/plugins/super-forms/uploads/php/files/4c1f6ff774b6c56ed9416845a7dc39f9/jufoxorum.pdf
http://grafosaleservice.cz/images/fck_editor/file/fabakimo.pdf
http://ambvetfanini.eu/userfiles/files/pepusopiroxumenukasogoxu.pdf
http://harasim.cz/uploaded/files/65281242778.pdf
http://ewtch.com/upload/files/musulusuvonaj.pdf
https://dafelia.com/files/45424946336.pdf
http://www.focitabor.hu/userfiles/file/70216981913.pdf
https://postele-z-masivu.sk/ckfinder/userfiles/files/napux.pdf
https://bxthirteen.wpengine.com/wp-content/plugins/super-forms/uploads/php/files/54b5f475e3d32d3ffea9a7d395c5477d/28873761180.pdf
http://www.tsssport.com/wp-content/plugins/formcraft/file-upload/server/content/files/1615a39a8c62ea---fojufokalojekifoni.pdf
http://3colorjazz.com/fckeditor/userfiles/image/vefejepidi.pdf
http://louisiana-arts.org.s150269.gridserver.com/siteuploads/editorimg/file/80314552741.pdf
http://www.telsercom.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613458f16a0e4---zifit.pdf
http://allseasonsart.com/uploads/fck_uploads/file/jozerikamokixoduraxirote.pdf
http://stlukesfp.org/ckfinder/userfiles/files/bebekoguwetegadi.pdf
http://www.myhhsi.com/wp-content/plugins/super-forms/uploads/php/files/6d1a6695a012789b8764ab5b74ca656f/silivamese.pdf
https://tedesco.pl/userfiles/file/soloziximituxemuza.pdf
https://nabijdefossa.nl/upload/files/55239284219.pdf
https://celebicatering.com/upload/ckfinder/files/49936020172.pdf
http://slsnn.ru/content/files/robefanibede.pdf
http://ilksolar.com/Images/Media/files/43624473073.pdf
https://coachtourbusrental.com/wp-content/plugins/formcraft/file-upload/server/content/files/1615b17733e008---duzupid.pdf
http://chono.mn/uploads/userfiles/files/vifusedijunawotoma.pdf

Embedded domains

feedproxy.google.com
christembassybarking.org
ambvetfanini.eu
ewtch.com
dafelia.com
bxthirteen.wpengine.com
www.tsssport.com
3colorjazz.com
louisiana-arts.org.s150269.gridserver.com
www.telsercom.com
allseasonsart.com
stlukesfp.org
www.myhhsi.com
tedesco.pl
nabijdefossa.nl
celebicatering.com
slsnn.ru
ilksolar.com
coachtourbusrental.com
www.w3.org
purl.org
ns.adobe.com
linhkienhunganh.vn
grafosaleservice.cz
harasim.cz

Embedded IP addresses

52.123.252.248
52.110.12.46
52.110.12.21
4.230.171.124
57.154.63.210
52.168.117.168
20.184.175.0
72.145.35.110
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report