MALICIOUS — be82452191.pdf

MALICIOUS — be82452191.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100). 5 of 50 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 642af61055169a453d9dddc1c672d9ae3c2189939148e572ba3932f920720569
SHA-1: fda38c3fba0cd9af540355983514007ca1a61631
MD5: 1f302ad7a158301ebccd8a4f38ae10c2
ssdeep: 1536:kDQNjrkEJspsatNU43mKptQ4e35ypORbrDdgzybqSy1oSd+eoUGRhD:FNfkB/x2K4MpLGby1oShoUGf
TLSH: T15A39D1F36157ED8FB6476B837DAB2A5E54CED2C96076D39080847B6C846C2BE2D21C40
Submitted as: be82452191.pdf
File type: pdf · Size: 85964 bytes
Verdict: malicious (95/100)

Detections (5 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!1F302AD7A158
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 95/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated suspicious by URL analysis: https://kuvobawodamelis.weebly.com/uploads/1/3/5/3/135350379/timolumixal.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://druttle.ru/wb?keyword=how%20to%20write%20an%20introduction%20for%20a%20character%20analysis, http://kowuterada.mygamesonline.org/78134608223.pdf, https://uploads.strikinglycdn.com/files/d9dc5ce5-d0a4-49cf-a780-97f0869a12d9/fusufawun.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Contacted 11 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9646 behavior events · 1 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
searchapp.bundleassets.example
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
ntp.ubuntu.com
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
desktop-hsgcbep
250.255.255.239.in-addr.arpa
desktop-hsgcbep._dosvc._tcp.local
desktop-hsgcbep(1)._dosvc._tcp.local
251.0.0.224.in-addr.arpa
79.243.254.169.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt

Dropped files

/opt/CAPEv2/storage/analyses/38623/files/f9d0cebec91aa5bb45af6b6a3f2f7d122168efddf2c6c36235bc59fa7b038480 - f9d0cebec91aa5bb45af6b6a3f2f7d122168efddf2c6c36235bc59fa7b038480
/opt/CAPEv2/storage/analyses/38623/files/05a0756034c9b079b188e4b1dc4d7af4ee7001148fe03f03f7eddefab2c9dec3 - 05a0756034c9b079b188e4b1dc4d7af4ee7001148fe03f03f7eddefab2c9dec3
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://druttle.ru/wb?keyword=how%20to%20write%20an%20introduction%20for%20a%20character%20analysis
http://kowuterada.mygamesonline.org/78134608223.pdf
https://uploads.strikinglycdn.com/files/d9dc5ce5-d0a4-49cf-a780-97f0869a12d9/fusufawun.pdf
https://kuvobawodamelis.weebly.com/uploads/1/3/5/3/135350379/timolumixal.pdf
https://uploads.strikinglycdn.com/files/e96bd0f6-53f2-4b67-8796-be2daee4e6da/labezonumuwoxatikuzitife.pdf
http://puveputado.sportsontheweb.net/examples_of_alkanes.pdf
https://cdn-cms.f-static.net/uploads/4369656/normal_6022f0d890fa3.pdf
http://adanakebap.org/pewunosorek1htu.pdf
http://gozudivigel.epizy.com/kajufataliz.pdf
http://zulonojaminipe.rf.gd/52706574417.pdf
https://levukuwaxumofet.weebly.com/uploads/1/3/1/3/131383949/kidoladudego-xofuki.pdf
https://uploads.strikinglycdn.com/files/c16f10ef-598f-4be9-93b6-9fbdfbd1c723/words_of_wisdom_for_new_mums.pdf
https://uploads.strikinglycdn.com/files/80895cf7-4581-4fe1-84de-2f1bdfefdca2/dell_latitude_e6430_battery_2_not_present.pdf
http://yesstore.pro/ronexowifumuv0653.pdf
https://zogadinarele.weebly.com/uploads/1/3/1/4/131409244/5393533.pdf
https://cdn-cms.f-static.net/uploads/4388818/normal_60239fbe13ba0.pdf
http://jisexapegumet.rf.gd/23158125954.pdf
https://dakikizubebara.weebly.com/uploads/1/3/4/8/134889455/topazirumirula-popodexonokufo-figeg.pdf
http://impergamon.com/meravuxagonekivege7dn1q.pdf
http://fatemalitu.iblogger.org/jizimisemavofa.pdf
http://dufojamimusim.atwebpages.com/stock_market_closed_good_friday_2020.pdf
https://static.s123-cdn-static.com/uploads/4470207/normal_5ffbb225d2964.pdf
https://cdn-cms.f-static.net/uploads/4379720/normal_606df9b59f3b4.pdf
http://wudenufodoroziv.scienceontheweb.net/list_of_important_days_in.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

druttle.ru
kowuterada.mygamesonline.org
uploads.strikinglycdn.com
kuvobawodamelis.weebly.com
puveputado.sportsontheweb.net
cdn-cms.f-static.net
adanakebap.org
gozudivigel.epizy.com
levukuwaxumofet.weebly.com
yesstore.pro
zogadinarele.weebly.com
dakikizubebara.weebly.com
impergamon.com
fatemalitu.iblogger.org
dufojamimusim.atwebpages.com
static.s123-cdn-static.com
wudenufodoroziv.scienceontheweb.net
www.w3.org
purl.org
ns.adobe.com
zulonojaminipe.rf.gd
jisexapegumet.rf.gd

Embedded IP addresses

74.179.77.204
72.145.35.114
20.50.73.5
52.123.252.223
20.184.175.8
85.210.193.152
52.110.12.18
20.76.201.171
162.159.142.9
52.123.128.14
4.230.171.124

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report