MALICIOUS — 7159c14c944bc6e8c6a892d98ce410c9f31216ad0443f9d8dfedf7d569d93308

MALICIOUS — 7159c14c944bc6e8c6a892d98ce410c9f31216ad0443f9d8dfedf7d569d93308 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 7159c14c944bc6e8c6a892d98ce410c9f31216ad0443f9d8dfedf7d569d93308
• SHA-1: 05269358eb4457ea00703277cd09f4d34e71c95d
• MD5: 88818c70fdd9996a05af81db6ee1351c
• ssdeep: 1536:eivDK8brlGss5kWqw/lMVgKv30d6XMNZ2eZ59JTgkcU:RRi5kxslMSy30yMNDZTJTg2
• TLSH: T18538D1F35187CC8CB58BBB036AFA10586456D28E6036DAA4448C7B6D80BC67E7F11F50
• Submitted as: 7159c14c944bc6e8c6a892d98ce410c9f31216ad0443f9d8dfedf7d569d93308
• File type: pdf · Size: 82139 bytes
• Verdict: malicious (96/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!88818C70FDD9
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1105
• T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Contacted 14 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
• Embedded link rated suspicious by URL analysis: https://too.kg/wp-content/plugins/super-forms/uploads/php/files/443102606a2a5a92efd23d731f028d02/63876523444.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://pistant.ru/uplcv?utm_term=animal+sounds+game+icebreaker, https://agsposure.org/wp-content/plugins/super-forms/uploads/php/files/3bdf6db2ac454a5a3bddfa1861d5235b/visifis.pdf, https://kayakbranson.com/wp-content/plugins/formcraft/file-upload/server/content/files/160847ea75e679---40281333989.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Extracted generic config (17 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9670 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• desktop-hsgcbep
• ntp.ubuntu.com
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

• C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\f35657dcdad710ccb5c6aedb5a223c61.png - 640df9582b2711962f7dfc69e0c19581e96b65372e2d7eb483d208763eb9780a
• C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - d06909ec239f3d186ffc3381a737940a2f0d42f53569a78b0e7bb4cdefff7ddc
• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://pistant.ru/uplcv?utm_term=animal+sounds+game+icebreaker
• https://agsposure.org/wp-content/plugins/super-forms/uploads/php/files/3bdf6db2ac454a5a3bddfa1861d5235b/visifis.pdf
• https://kayakbranson.com/wp-content/plugins/formcraft/file-upload/server/content/files/160847ea75e679---40281333989.pdf
• http://honda-vo.com/upload/file/wewozewadavivawakibim.pdf
• https://too.kg/wp-content/plugins/super-forms/uploads/php/files/443102606a2a5a92efd23d731f028d02/63876523444.pdf
• http://ttlengenharia.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160bcdfed28c16---62343536234.pdf
• http://krindustria.com.br/site/wp-content/plugins/formcraft/file-upload/server/content/files/1608e4d258e2f9---89241047604.pdf
• https://leicht-spb.ru/wp-content/plugins/super-forms/uploads/php/files/fdbabe2a6062110d4f36330c4bfc9bac/94656422547.pdf
• https://mytopics.it/uploads/file/96726541317.pdf
• http://for-rent-aalst.com/wp-content/plugins/formcraft/file-upload/server/content/files/16098550c40594---luxowiw.pdf
• http://asiadomainstore.com/userfiles/file/37585322063.pdf
• https://www.sussexweddingservices.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1606de5aa30924---9872750008.pdf
• https://neavocats.com/wp-content/plugins/super-forms/uploads/php/files/eb429d41531067c3e15a729efed00833/68518419304.pdf
• https://actor-conseil.com/files/file/ranufusaxorefuneferupiz.pdf
• http://bestforfishing.com/wp-content/plugins/super-forms/uploads/php/files/13b615cac3a17ad9d4fb07381758743e/wetivogometikaw.pdf
• https://agsposure.org/wp-content/plugins/super-forms/uploads/php/files/73627f8e38c8b12887364c0c7f27a14e/zefoxesu.pdf
• http://pmmagic.vn/userfiles/file/vodawowobonelabubivazuvav.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Embedded domains

• pistant.ru
• agsposure.org
• kayakbranson.com
• honda-vo.com
• ttlengenharia.com.br
• krindustria.com.br
• leicht-spb.ru
• mytopics.it
• for-rent-aalst.com
• asiadomainstore.com
• www.sussexweddingservices.co.uk
• neavocats.com
• actor-conseil.com
• bestforfishing.com
• www.w3.org
• purl.org
• ns.adobe.com
• too.kg
• pmmagic.vn

Embedded IP addresses

• 135.233.95.80
• 172.66.2.5
• 48.211.4.16
• 4.230.171.124
• 20.247.184.197
• 85.210.193.152
• 135.232.92.137
• 52.168.117.169
• 52.123.128.14
• 135.234.160.244
• 72.145.35.106
• 203.26.79.13
• 20.89.1.10
• 74.178.76.44

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report