MALICIOUS — 3400899360.pdf

MALICIOUS — 3400899360.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 67c3e6c480c25395bb13617131b85d81237b1ebe75e474005bce2bfd1eddc756
SHA-1: 02ed6bef9086e35e01a2b8d52836237826739d4b
MD5: 25cf7ca80c2e5f983b0cae68656a9402
ssdeep: 1536:A3agkfd7mEZ2eXd1OsKJctQcov+3k10RAj2ZWbpONiWZjlqKqWs1xatRpvAu:UNkoEFXesKJctQcbi0R42bNbjR/s18t9
TLSH: T1B839D0F33197DD4C7B979F07EAA612A8714AD6485272F7904088B5BCC8BC77DAE00A50
Submitted as: 3400899360.pdf
File type: pdf · Size: 87965 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 16 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://trunglam.vn/uploads/userfiles/file/8128833980.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: http://aire-limpio.com/img/editor/file/degizujepatoziwaja.pdf, https://law.myvzl.com/wp-content/plugins/super-forms/uploads/php/files/dssdfq5ckjr49eeb484v7vqg5f/43515276272.pdf, https://nicemexico.net/wp-content/plugins/formcraft/file-upload/server/content/files/160ac5c884f9b8---95805775955.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9745 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
desktop-hsgcbep
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\b0d691aae88028967b6cef9ca00fc0a4.png - 95af47ab6cb2b7d597f0240c41f045ba94a0a74c62a4b4d8d001644d0331c13d
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 433e71ed5b328cb2f3a208efb7acdcc58c32e9c2184d947bab71831e9482fd30
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/cv9VXjIrmdE/uplcv?utm_term=repeated+measures+anova+within+subjects
http://aire-limpio.com/img/editor/file/degizujepatoziwaja.pdf
https://law.myvzl.com/wp-content/plugins/super-forms/uploads/php/files/dssdfq5ckjr49eeb484v7vqg5f/43515276272.pdf
https://nicemexico.net/wp-content/plugins/formcraft/file-upload/server/content/files/160ac5c884f9b8---95805775955.pdf
http://ledseoul.com/userData/board/file/fubakopukejidikukele.pdf
http://netpost.vn/upload/userfiles/files/17522892322.pdf
http://lohs69.com/clients/82366/File/fumovonoru.pdf
http://trunglam.vn/uploads/userfiles/file/8128833980.pdf
http://www.carolglassman.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d096327764a---47228768364.pdf
https://cms.blauraum.com/wp-content/plugins/super-forms/uploads/php/files/f6fe8a8be9e21f6eff40f75ce1abb14f/kekode.pdf
http://chicagohalo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160777d1011f88---77057495563.pdf
https://www.jemelectric.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b28922e67a1---10754056696.pdf
https://gulertrafik.com/wp-content/plugins/super-forms/uploads/php/files/ueivtesrvt6oomhrluqna10i2f/xavetapipaderetubufisagu.pdf
http://fxmeat.com/upload/file/aa728791c6c1e42e28d498247ddc2f64.pdf
http://www.absolutecateringla.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607563348e8ab---lilefaxowaxobodusivon.pdf
http://pcccmiennam.com/media/ftp/file/51542969958.pdf
https://workinhotel.com/upload/fckfile/zazumofugaraxatupow.pdf
http://southportrubbish.com/wp-content/plugins/formcraft/file-upload/server/content/files/160aec1f9bd408---nozupa.pdf
http://www.armstrongre.com/files/files/31919652854.pdf
https://www.davinci.dk/wp-content/plugins/formcraft/file-upload/server/content/files/16083ccc0b74d3---97963356984.pdf
https://mindweave.co.uk/wp-content/plugins/super-forms/uploads/php/files/e8upv2g05q6us9efheah0pgsr5/sisijives.pdf
https://eliteswimmingpoolsinc.com/wp-content/plugins/super-forms/uploads/php/files/hsiu8bnar4hjb6g6tvuqev1go6/75330413829.pdf
http://targhevaticane.it/userfiles/files/tazelenufodizid.pdf
http://terminsk.by/pics/files/zonibo.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

feedproxy.google.com
aire-limpio.com
law.myvzl.com
nicemexico.net
ledseoul.com
lohs69.com
www.carolglassman.com
cms.blauraum.com
chicagohalo.com
www.jemelectric.com
gulertrafik.com
fxmeat.com
www.absolutecateringla.com
pcccmiennam.com
workinhotel.com
southportrubbish.com
www.armstrongre.com
mindweave.co.uk
eliteswimmingpoolsinc.com
targhevaticane.it
www.w3.org
purl.org
ns.adobe.com
netpost.vn
trunglam.vn

Embedded IP addresses

172.172.255.218
40.84.85.40
52.123.252.192
4.144.132.114
52.110.12.53
4.230.171.124
48.211.4.16
13.89.179.15
20.231.239.246
40.99.133.210
52.123.129.14
20.165.94.63
135.233.45.223
72.145.35.98
203.26.79.13
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report