MALICIOUS — 6db2dbcac6fdc69037bc3eb9c25aa0fa529d5955559c8ede332bd353610d0e7d

MALICIOUS — 6db2dbcac6fdc69037bc3eb9c25aa0fa529d5955559c8ede332bd353610d0e7d is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 6db2dbcac6fdc69037bc3eb9c25aa0fa529d5955559c8ede332bd353610d0e7d
• SHA-1: 04edaa455b2fefe3aaae0cd25a0681a0d9ef7c03
• MD5: 8e20f4f50e589d5a0438d7a9fb7347a5
• ssdeep: 1536:hLlxWtHfx/lrt5l2YkxdPCcN4fVKemYVTEczI55xVKgpWMgU8WapOtQLM52AWZ7P:5lxWZRlNVkx1Ce6VRnTEuO5XFrgUttQF
• TLSH: T1F038D0F31297ED5C37879F43ADEA11A8918AD7842231EBA04148BB3CD47C5BEBE04651
• Submitted as: 6db2dbcac6fdc69037bc3eb9c25aa0fa529d5955559c8ede332bd353610d0e7d
• File type: pdf · Size: 83337 bytes
• Verdict: malicious (98/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1105
• T1566.002

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated malicious by URL analysis: http://zxpgw.com/userfiles/file/vepuvekaj.pdf - network signal, weight 0.70, confidence 0.80
• Contacted 20 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
• Embedded network infrastructure: https://woft-dining.com/webroot/editor-uploads/files/55771984671.pdf, https://beautydiction.com/ckfinder/userfiles/files/derekojafaw.pdf, https://personalloan2u.com/wp-content/plugins/super-forms/uploads/php/files/7bfd9d32f8fb8ca45e1f3960bd720eb2/xelirabewefewava.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9822 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• 250.255.255.239.in-addr.arpa
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• desktop-hsgcbep._dosvc._tcp.local
• desktop-hsgcbep(1)._dosvc._tcp.local
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• ntp.ubuntu.com
• desktop-hsgcbep
• http://www.msftconnecttest.com/connecttest.txt

Dropped files

• C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 0f71518d8a6d64915227a5e2c2f67bdf266a19864fe152dbcdbaf188561edc69
• C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\5847189a1343285228931eee166a6d64.png - 1a3c2f898402c530fe02e295b015f41c3dec18ea1bfa3b76f77eb9d9b34b715f
• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://feedproxy.google.com/~r/Uplcv/~3/3CAf4wW3hvY/uplcv?utm_term=windows+how+to+combine+pdfs
• https://woft-dining.com/webroot/editor-uploads/files/55771984671.pdf
• https://beautydiction.com/ckfinder/userfiles/files/derekojafaw.pdf
• https://personalloan2u.com/wp-content/plugins/super-forms/uploads/php/files/7bfd9d32f8fb8ca45e1f3960bd720eb2/xelirabewefewava.pdf
• https://mithermomix.com.mx/wp-content/plugins/super-forms/uploads/php/files/2aef7f1c717c9e47aaf7aba3f4d13eea/miwosokofugoxa.pdf
• http://paintingservicesonline.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1609203c570cc7---vobolimesaterajunijibe.pdf
• http://littlepearlbooks.in/data/eimages/file/jonojim.pdf
• http://zxpgw.com/userfiles/file/vepuvekaj.pdf
• http://sashtraayurveda.com/ckfinder/userfiles/files/33906834038.pdf
• https://karinbentum.nl/uploads/file/41153475804.pdf
• http://www.christinemartin.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160944c57068a2---zuvibi.pdf
• http://paletydozahrady.cz/ckfinder/userfiles/files/73680814844.pdf
• http://mariangelesorrico.com/galeria/files/41279951234.pdf
• https://myshalewell.com/userfiles/file/degefuxezasiwukupo.pdf
• https://comesa.com.pe/wp-content/plugins/super-forms/uploads/php/files/rvsvlvpavfv2gj2gg7ngc2pnv3/jorodasevex.pdf
• http://www.opencalgary.org/wp-content/plugins/formcraft/file-upload/server/content/files/1608b8e7cd5534---27282853183.pdf
• http://africareview.in/userfiles/file/68815533990.pdf
• https://camgloberealtor.com/userfiles/file/rubusovikosebot.pdf
• http://ecohort.com/userfiles/files/30018304154.pdf
• http://ilovehikari.com/uploads/files/wenuz.pdf
• https://miamiuniquelimo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160989232d88a6---wuxukobasexaxan.pdf
• http://gdwtechnology.com/fckeditor/file/47754715219.pdf
• http://hayatteknoloji.com/webimage/file/38193679123.pdf
• http://serting.eu/userfiles/files/vajoligimagu.pdf
• http://a1climbing.com/userfiles/files/galukodaledovo.pdf

Embedded domains

• feedproxy.google.com
• woft-dining.com
• beautydiction.com
• personalloan2u.com
• mithermomix.com.mx
• paintingservicesonline.ca
• littlepearlbooks.in
• zxpgw.com
• sashtraayurveda.com
• karinbentum.nl
• www.christinemartin.co.uk
• mariangelesorrico.com
• myshalewell.com
• www.opencalgary.org
• africareview.in
• camgloberealtor.com
• ecohort.com
• ilovehikari.com
• miamiuniquelimo.com
• gdwtechnology.com
• hayatteknoloji.com
• serting.eu
• a1climbing.com
• rwd1.thadv.com
• wheelmartthailand.com

Embedded IP addresses

• 172.172.255.217
• 4.150.223.109
• 92.223.78.30
• 162.159.142.9
• 4.150.223.107
• 52.110.12.5
• 20.247.184.197
• 4.230.171.124
• 57.155.101.212
• 74.178.240.61
• 20.76.201.171
• 13.89.179.15
• 52.123.128.14
• 40.99.134.2
• 135.232.92.34
• 203.26.79.13
• 48.200.63.27
• 20.42.73.28
• 52.148.114.188
• 142.250.195.163

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report