MALICIOUS — 65fc8b25eaf160ecf862036ba7522612cae48fdba40ba8023b2dc13936fddebc

MALICIOUS — 65fc8b25eaf160ecf862036ba7522612cae48fdba40ba8023b2dc13936fddebc is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 65fc8b25eaf160ecf862036ba7522612cae48fdba40ba8023b2dc13936fddebc
SHA-1: 435c0b3ec2b7c5634691f027d0bb59fa8388aa3e
MD5: 3d6be770d45d8dc6b4a8eb19bef227c3
ssdeep: 1536:JcEuTGm1C4ZsfCOcYr1aGG6E+J7LWmxH+P+RyZ4PoqTb2+XWApO6YUE:TuTGmXZs7BddE9GRyZ4Po+NW6M
TLSH: T17037D0F321ABCD8D77979F132EEB1199608BD7445272EBA054887B7C897C97DAE00600
Submitted as: 65fc8b25eaf160ecf862036ba7522612cae48fdba40ba8023b2dc13936fddebc
File type: pdf · Size: 70677 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://www.saveurspoitoucharentes.com/admin/ckfinder/userfiles/files/65413200238.pdf - network signal, weight 0.70, confidence 0.80
Contacted 15 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://pericosrentcar.com.mx/wp-content/plugins/formcraft/file-upload/server/content/files/1614317adb8eeb---73652620121.pdf, https://tjp2-hotlink-j3t.com/contents/files/50003105883.pdf, http://nuestratierrapremios.com/campannas/file/95043319402.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9643 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - e610f691b2707d23ee13e7fe2bd03d853ebad80a6c92a0c51a79557c2ec4f4b4
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\7264cebf1c0cf2373cb52d2987e0e79a.png - fa963e691dc84128c230a950b81a49487fd1326890447c56af605a5552fe9d09
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/skout/mBVl/~3/GLLx1DTH0VQ/uplcv?utm_term=transfer+photos+from+ipad+to+pc+without+itunes
http://pericosrentcar.com.mx/wp-content/plugins/formcraft/file-upload/server/content/files/1614317adb8eeb---73652620121.pdf
https://tjp2-hotlink-j3t.com/contents/files/50003105883.pdf
http://nuestratierrapremios.com/campannas/file/95043319402.pdf
http://www.saveurspoitoucharentes.com/admin/ckfinder/userfiles/files/65413200238.pdf
http://sb-78.ru/files/file/66382592249.pdf
http://lonerangerfanclub.com/ckfinder/userfiles/files/kopujafizune.pdf
https://promise-land.com/upload/file/62710908160.pdf
https://sdhouse.info/ckfinder/userfiles/files/pazezemuke.pdf
https://grahampropertytax.com/wp-content/plugins/super-forms/uploads/php/files/3b28bd9c2eeab2d46080650ceb1a7773/69012212809.pdf
https://yuvasarkar.org/userfiles/file/bolodiligarefo.pdf
http://ranchobg.com/img/file/lufoxafolixirez.pdf
https://shrmivirtual.org/wp-content/plugins/super-forms/uploads/php/files/f2058397b95f7dcd3d2ed766370f1bbd/xametuwo.pdf
https://qkon.ca/images/file/digigudoxa.pdf
http://aumnat2car.com/ckfinder/core/connector/php/upload/files/65060326388.pdf
http://agavietnam.com/img/files/77794478752.pdf
http://siciny.eu/userfiles/file/zoxop.pdf
http://musicfriend.vn/public/default/ckeditor/files/98859442501.pdf
http://liavanhaeringen.nl/userfiles/files/41486840864.pdf
http://konberdbio.com/upload/files/lebajefuvetu.pdf
http://www.johnknox.ch/wp-content/plugins/formcraft/file-upload/server/content/files/16135a5ccbb58d---kimemolaj.pdf
https://chingchia.com/uploads/files/202109241832166845.pdf
http://serendipityorlando.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614995fb6120d---6530702098.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/

Embedded domains

feedproxy.google.com
pericosrentcar.com.mx
tjp2-hotlink-j3t.com
nuestratierrapremios.com
www.saveurspoitoucharentes.com
sb-78.ru
lonerangerfanclub.com
promise-land.com
sdhouse.info
grahampropertytax.com
yuvasarkar.org
ranchobg.com
shrmivirtual.org
qkon.ca
aumnat2car.com
agavietnam.com
siciny.eu
liavanhaeringen.nl
konberdbio.com
www.johnknox.ch
chingchia.com
serendipityorlando.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

172.66.2.5
52.110.12.45
4.230.171.124
85.210.196.11
20.247.185.124
74.178.76.128
52.123.128.14
40.103.64.242
52.123.252.198
20.42.65.85
203.26.79.13
20.50.80.215
92.223.78.30
4.150.223.100
52.178.17.234

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report