MALICIOUS — 6de644dba8e2d3349b5c4e32166043b98673af3ffdef189f87babc796bd22555

MALICIOUS — 6de644dba8e2d3349b5c4e32166043b98673af3ffdef189f87babc796bd22555 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 6de644dba8e2d3349b5c4e32166043b98673af3ffdef189f87babc796bd22555
SHA-1: 1098546e42f3f61e543cc5883419e122706f9575
MD5: c052f650312a9d0509360baae8bffbb0
ssdeep: 1536:9M+LfFnyzkgPA6Dcfk5Pt8NcSZcZPW/tcVmR1H4XKBjjLWQpOCWdL7Fd:D24aYkRiNcSZcGcV01H4XYj2CW573
TLSH: T1DF37C0F321ABDD8C73D68B0B29F25159605ADB5C2122EE9084C8B56CC57C6BEBF00A50
Submitted as: 6de644dba8e2d3349b5c4e32166043b98673af3ffdef189f87babc796bd22555
File type: pdf · Size: 72568 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://chamdure.com/DATA/files/lelerozitadunib.pdf - network signal, weight 0.70, confidence 0.80
Contacted 18 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://pixomot.ru/uplcv?utm_term=simple+contacts+android, http://embeddedhr.com/ckfinder/userfiles/files/22143086268.pdf, https://fetogram.com/images/upload/files/5609898377.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9575 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
desktop-hsgcbep._dosvc._tcp.local
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787897772&P2=404&P3=2&P4=f4KeOKXMCerfILMWVdb5zV1D4fxWjUZRCkNqmAH3HwYsFiP8LEXcIyH%2bG7SjbBIHVux8J6RxEtAC7rLGNgud3g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787897832&P2=404&P3=2&P4=W5ClLVUMKav7HOU8NRmM%2fuM7xKRwi%2f6lsBMIrAlUlKSl8bvebwV%2fVcktN6Hj1Txp4GrE1FLmlXzic0Jt%2fX6FOQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\bc610fd6b02f54ff1b3035b807d035b4.png - 730baa52a482dab2048ba34cffe25e88baec91f82004a036438b60d2c27533f6
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 4452c9a4e906a33e2536e27d4928b90fee884b1a83b9f3ff9c1fa2a361b9313f
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://pixomot.ru/uplcv?utm_term=simple+contacts+android
http://embeddedhr.com/ckfinder/userfiles/files/22143086268.pdf
https://fetogram.com/images/upload/files/5609898377.pdf
http://iowatriallawyer.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/fujutepuzalowupugikuteg.pdf
http://chamdure.com/DATA/files/lelerozitadunib.pdf
https://adiwirawanbali.com/wp-content/plugins/super-forms/uploads/php/files/d05dec4f094380fbac3b08f495dbaf5c/24845298597.pdf
http://artiguardia.pl/userfiles/file/12148858508.pdf
http://avs-market.ru/admin/ckfinder/userfiles/files/zomobererurefamilubevep.pdf
https://bitree.ru/ckfinder/userfiles/files/busokipu.pdf
http://zs-oilfieldequip.ru/d/files/fowefibiwirutobegalazuku.pdf
http://tubemakingmachine.com/uploadfile/files/61979467023.pdf
http://www.movingintofreedom.com/wp-content/plugins/formcraft/file-upload/server/content/files/16141e0a62d6a5---dimagagexiv.pdf
http://www.gonouvellezelande.com/files/17997494609.pdf
http://hoteldanang.com/uploads/images/files/72498996976.pdf
https://ipekyolumedya.com/resim_galeri/file/wogobagibiwutufofas.pdf
https://dragonexpressml.com/userfiles/files/xozugunijavexos.pdf
https://eobliecky.sk/userfiles/file/49303275024.pdf
https://kenhquangcao.vn/uploads/files/zisatezi.pdf
http://slstudio.it/userfiles/files/naxevurutivitoderetemo.pdf
http://vinhthuanvietnam.com/upload/files/79527675373.pdf
https://www.theoakshealthcare.com/my_content/js/ckfinder/userfiles/files/xiwazafaliwa.pdf
http://clainvest.pl/userfiles/file/butajefa.pdf
http://ivelinabozilova.com/userfiles/file/noxadunubexuzefotapifu.pdf
https://baigiangtoanhoc.com/upload/files/dimexowojavelajuwizinit.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

pixomot.ru
embeddedhr.com
fetogram.com
iowatriallawyer.com
chamdure.com
adiwirawanbali.com
artiguardia.pl
avs-market.ru
bitree.ru
zs-oilfieldequip.ru
tubemakingmachine.com
www.movingintofreedom.com
www.gonouvellezelande.com
hoteldanang.com
ipekyolumedya.com
dragonexpressml.com
slstudio.it
vinhthuanvietnam.com
www.theoakshealthcare.com
clainvest.pl
ivelinabozilova.com
baigiangtoanhoc.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

20.184.175.6
74.178.232.29
162.159.142.9
20.42.179.192
52.110.12.26
4.230.171.124
20.247.184.142
74.178.240.51
20.236.44.162
135.232.92.137
52.123.128.14
40.99.134.18
172.178.240.163
72.154.7.16
203.26.79.13
52.123.252.216
52.178.17.233
172.175.111.170

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report