MALICIOUS — 71b8b42f4140b9c60b10c52594481e82c2f0dda5769763370bb10875206e7948

MALICIOUS — 71b8b42f4140b9c60b10c52594481e82c2f0dda5769763370bb10875206e7948 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (80/100). 2 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 71b8b42f4140b9c60b10c52594481e82c2f0dda5769763370bb10875206e7948
• SHA-1: 5304643752e97291f882e917fc74ff3cfc240e4c
• MD5: 3fa5e02625bc326f365b53589c725c83
• ssdeep: 3072:Hjx9PMB38IOGYYg38C2O3zu3psQNGzRjYwXSJSwMUUK7jtZb8aC70+5B1YO5qOj:Dx9cEMDEzu3psuGzNYwXgd8Qd2061R5/
• TLSH: T1283EF2F2970A7A0CB183841399F8B525C7ACE62C9251F6F4614D5B3CD0D427E6EA6B03
• Submitted as: 71b8b42f4140b9c60b10c52594481e82c2f0dda5769763370bb10875206e7948
• File type: pdf · Size: 147219 bytes
• Verdict: malicious (80/100)

Detections (2 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: Trojan:PDF/Phish.CFN!MTB

MITRE ATT&CK

• T1105

Why this verdict

The malicious score of 80/100 is the fusion of 7 weighted signals:

• Microsoft Defender flagged Trojan:PDF/Phish.CFN!MTB (rule Trojan:PDF/Phish.CFN!MTB) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://netcdn.tw/app/1330123889/pubg-uc-exchange-game-hack - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Contacted 5 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

1018 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• ntp.ubuntu.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• 23.40.52.85
• 23.11.37.157
• 40.126.14.163
• 52.230.59.222 SG · Singapore · AS8075 Microsoft Corporation
• 52.123.252.240 AU · Sydney · AS8075 Microsoft Corporation
• 23.33.238.135
• 23.198.40.44
• 4.230.171.124 KR · Seoul · AS8075 Microsoft Corporation
• 23.33.238.207
• 23.33.238.104
• 23.33.238.114
• 57.155.104.224 SG · Singapore · AS8075 Microsoft Limited UK

Dropped files

• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• http://netcdn.tw/app/1330123889/pubg-uc-exchange-game-hack
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• netcdn.tw

Embedded IP addresses

• 52.230.59.222
• 52.123.252.240
• 4.230.171.124
• 57.155.104.224
• 52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report