MALICIOUS — 60244f78688bbf9ea1e8876690b4dd32bc376e1096f34d361c400ada59728288

MALICIOUS — 60244f78688bbf9ea1e8876690b4dd32bc376e1096f34d361c400ada59728288 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 60244f78688bbf9ea1e8876690b4dd32bc376e1096f34d361c400ada59728288
SHA-1: 03a2dfbdb6d45a20340a098107c117ca140f7f87
MD5: ca84abbdce0e057ac59b51dfe1af755a
ssdeep: 1536:RrGPv/9auJ6hWZgpeULo06ArFDf/ETJ54RC5ooyDBnw4/UyAS6snrI:kn9DJr6pe2oaDfi54RC5opDBw4/jAHsc
TLSH: T13739CFE323D3CF4C6E8B670FAAEA4C582489C24673739ED07049A66DD46C6AD7F40911
Submitted as: 60244f78688bbf9ea1e8876690b4dd32bc376e1096f34d361c400ada59728288
File type: pdf · Size: 89408 bytes
Verdict: malicious (98/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!CA84ABBDCE0E
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4422168/normal_5fc8d672d23f7.pdf - network signal, weight 0.70, confidence 0.80
Contacted 16 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://wastran.ru/pbw?utm_term=monoxido+de+dicloro+nomenclatura, https://uploads.strikinglycdn.com/files/5b958cf0-dd0c-4f59-aa1e-d7131001089e/92505412467.pdf, https://static.s123-cdn-static.com/uploads/4422168/normal_5fc8d672d23f7.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9785 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
250.255.255.239.in-addr.arpa
desktop-hsgcbep._dosvc._tcp.local
ntp.ubuntu.com
_dosvc._tcp.local
desktop-hsgcbep
http://www.msftconnecttest.com/connecttest.txt

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - c87286cae590106e7110a691c6660cb5a74d44b898d3a3bd61f4fd2c79b96538
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\1687ba3684004cffe285579059f1ab08.png - f45d4688c6c444acc1965253978ebe5d3a0552cebc771fc73396a1f37d8ba373
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://wastran.ru/pbw?utm_term=monoxido+de+dicloro+nomenclatura
https://uploads.strikinglycdn.com/files/5b958cf0-dd0c-4f59-aa1e-d7131001089e/92505412467.pdf
https://static.s123-cdn-static.com/uploads/4422168/normal_5fc8d672d23f7.pdf
https://cdn-cms.f-static.net/uploads/4408176/normal_5fe90f0cf2f6e.pdf
https://static.s123-cdn-static.com/uploads/4447433/normal_6007294a14e6d.pdf
https://cdn-cms.f-static.net/uploads/4402481/normal_602689f31e689.pdf
https://uploads.strikinglycdn.com/files/d97439e4-03c6-4d7a-b555-055c6732bb83/86759122583.pdf
https://gigufeti.weebly.com/uploads/1/3/4/6/134633464/xavonoxar_ladofo_lasokafezugu_fenasovuv.pdf
https://kisejugizojo.weebly.com/uploads/1/3/4/6/134656745/tafitajisirevadiz.pdf
https://cdn-cms.f-static.net/uploads/4419193/normal_6054cf2d3a047.pdf
https://uploads.strikinglycdn.com/files/abdb4c8f-a581-4050-8754-75b08f80b5f6/what_is_diamond_dallas_page_yoga.pdf
https://uploads.strikinglycdn.com/files/fb82899b-51ea-4de5-a1f1-b4ec31844cd1/85002751567.pdf
https://uploads.strikinglycdn.com/files/c158a826-e124-43c5-94a9-db4bd523b047/28124653388.pdf
https://cdn-cms.f-static.net/uploads/4402717/normal_600d3230465ec.pdf
https://luxisawevevolal.weebly.com/uploads/1/3/2/6/132682936/zuwefugilo.pdf
https://static.s123-cdn-static-d.com/uploads/4388420/normal_60b728b41e2ea.pdf
https://cdn-cms.f-static.net/uploads/4458625/normal_606c60a8d7b13.pdf
https://cdn-cms.f-static.net/uploads/4484994/normal_602ca0155cee7.pdf
https://linonorimezolup.weebly.com/uploads/1/3/7/5/137519838/2055644.pdf
https://uploads.strikinglycdn.com/files/2d7d223d-01e1-492b-83a2-2bbed094c76c/xibapetun.pdf
https://siwinapevaz.weebly.com/uploads/1/3/4/3/134338690/meduvevudi.pdf
https://cdn-cms.f-static.net/uploads/4369311/normal_60152e9bdd81a.pdf
https://cdn-cms.f-static.net/uploads/4383565/normal_604604fecf5e9.pdf
https://cdn-cms.f-static.net/uploads/4401983/normal_60687893a8c6c.pdf
https://uploads.strikinglycdn.com/files/9ab3d902-302d-47af-aeef-50b3c29a0a2d/examen_olimpiada_de_matematicas_bachillerato.pdf

Embedded domains

wastran.ru
uploads.strikinglycdn.com
static.s123-cdn-static.com
cdn-cms.f-static.net
gigufeti.weebly.com
kisejugizojo.weebly.com
luxisawevevolal.weebly.com
static.s123-cdn-static-d.com
linonorimezolup.weebly.com
siwinapevaz.weebly.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

20.50.73.14
20.42.73.31
20.42.179.204
52.123.252.224
52.110.12.8
4.230.171.124
135.232.92.97
74.179.77.204
20.236.44.162
52.123.128.14
52.123.252.204
72.153.5.130
203.26.79.13
52.123.252.236
92.223.78.30
135.233.95.80

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report