MALICIOUS — 65a88745f43df6b1fe559645a3e41faa8194bfebe13e549c6df6d4aefe645916

MALICIOUS — 65a88745f43df6b1fe559645a3e41faa8194bfebe13e549c6df6d4aefe645916 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 65a88745f43df6b1fe559645a3e41faa8194bfebe13e549c6df6d4aefe645916
SHA-1: b60348bf1bf090122eee6a2adf29eddb37c25c98
MD5: 47c7664c9c9fe94a532721b606ed07a3
ssdeep: 1536:PnQp5MlAglLnUbauyM7Jg0oAE4fwKKugHnWOpOwri8bekGsWwmcSFbrPcr:o7MC4Lstg0oAErKKjHkwri8SkGYyg
TLSH: T13439D0F33157DE1D76DB9B037AEB1159B08AE3886260DB1050C8B7BC957CABEAE00550
Submitted as: 65a88745f43df6b1fe559645a3e41faa8194bfebe13e549c6df6d4aefe645916
File type: pdf · Size: 87849 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://ongxoanhdpe.vn/upload/files/57246307019.pdf - network signal, weight 0.70, confidence 0.80
Contacted 19 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://crysiq.ru/uplcv?utm_term=surds+practice+questions+with+answers, https://bellcera.60km.com/upload/files/bonijamadofedusitoxipuvu.pdf, https://torbay.ru/images/uploads/file/62385415653.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9713 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\48269126a42bc655350968911227a1dd.png - 6e820ede2fb86f72515581f4a106d29ae9221280d015f0952759f10ddda43626
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 0efcef68158e3fcce9e22d8a1009a582f985cf3a4598cf45420553026caae212
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://crysiq.ru/uplcv?utm_term=surds+practice+questions+with+answers
https://bellcera.60km.com/upload/files/bonijamadofedusitoxipuvu.pdf
https://torbay.ru/images/uploads/file/62385415653.pdf
https://schreinerheusi.de/wp-content/plugins/formcraft/file-upload/server/content/files/16136488bb6508---1057479418.pdf
http://ongxoanhdpe.vn/upload/files/57246307019.pdf
http://ibnuaffan.com/ckfinder/userfiles/files/25228177772.pdf
http://www.hangmandigital.com/files/file/nigidesoforafoxokuvisixuf.pdf
https://nawaasha.org/userfiles/file/loxefizisexig.pdf
http://itineraire-consulting.com/ckfinder/userfiles/files/safavekedu.pdf
https://zarrue.com/app/media/images_description/files/vujipunojozil.pdf
http://creativeindustries.ru/uploads/userfiles/file/79694435340.pdf
http://pravkniga.ru/files/userfiles/files/46177662481.pdf
http://toroisg.com/public/images/files/miponekul.pdf
https://thehouseproduction.net/file/bewodotej.pdf
http://mc-opony.pl/files/file/xinujogumigudomigosem.pdf
http://tutek.eu/userfiles/file/16057168196.pdf
https://almudenafernandez.co/ckfinder/userfiles/Files/42474390344.pdf
http://allergyc.news-read.com/upload/files/43748887971.pdf
http://allineers.netlovestories.com/upload/files/torovo.pdf
http://hijoin.hu/editor_up/sobakafirex.pdf
https://tepihtrava.rs/files/44764406107.pdf
http://skkl.cn/filespath/files/20210913064359.pdf
https://x-leather.com/radsportfiles/file/fewokigosikipukoda.pdf
http://lalitas-thaimassage-spa.de/wp-content/plugins/formcraft/file-upload/server/content/files/16130995ee3ec2---35790900538.pdf
http://intrinhgia.com/admin/webroot/upload/image/files/tiwupilisepelaraxaru.pdf

Embedded domains

crysiq.ru
bellcera.60km.com
torbay.ru
schreinerheusi.de
ibnuaffan.com
www.hangmandigital.com
nawaasha.org
itineraire-consulting.com
zarrue.com
creativeindustries.ru
pravkniga.ru
toroisg.com
thehouseproduction.net
mc-opony.pl
tutek.eu
almudenafernandez.co
allergyc.news-read.com
allineers.netlovestories.com
skkl.cn
x-leather.com
lalitas-thaimassage-spa.de
intrinhgia.com
kanat.com
www.w3.org
purl.org

Embedded IP addresses

52.182.143.212
20.50.201.204
4.150.223.114
48.211.4.16
52.110.12.53
52.110.12.49
4.230.171.124
40.84.97.4
20.247.184.142
74.178.240.61
20.231.239.246
52.123.129.14
135.233.45.223
4.150.223.101
20.42.65.89
203.26.79.13
92.223.78.30
48.192.143.121
52.168.117.169

File paths

N:\yF

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report