MALICIOUS — 71d91defa77a64b85f8c148a0c25f067eec8cd81c6b86aed3fd956d3d1d51f39

MALICIOUS — 71d91defa77a64b85f8c148a0c25f067eec8cd81c6b86aed3fd956d3d1d51f39 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 71d91defa77a64b85f8c148a0c25f067eec8cd81c6b86aed3fd956d3d1d51f39
SHA-1: 032ab5c04dc6d6368cd7eea1eee6b38294b02b76
MD5: d36b2ef15c08abc5c622b5d8f5893952
ssdeep: 1536:/3exKp1ilu9sWx92tZpTNFXxBInfkKYWpFNxGgifwEyRWxp2nUfLmTPLTkLTWap+:/ewIlQs8o/F0dNxGI2ByTULcnD
TLSH: T15A3ACFF32167DD5D76879F43B9BE116C204ED6942632DF5004C8BA6C8A7C2BE6F00A91
Submitted as: 71d91defa77a64b85f8c148a0c25f067eec8cd81c6b86aed3fd956d3d1d51f39
File type: pdf · Size: 95114 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Contacted 17 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://jagatjyotischool.org/jagatjyotischool/userfiles/file/10744699010.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: http://alimentosldm.com/userfiles/file/13773415717.pdf, http://jagatjyotischool.org/jagatjyotischool/userfiles/file/10744699010.pdf, http://www.rec39.ru/wp-content/plugins/super-forms/uploads/php/files/ac8da552a29146e2ddc66b6599eff34d/67510100546.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9666 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787814989&P2=404&P3=2&P4=XHaziEkaLtyMjRYU08EvohUK67krZAti5eYYblGR52gZxFVMYRWHUY%2fUjueVKYMF7UjTiiO8djtdUop%2bDGH%2b1Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\c4b8863ee9a5a73a11fb22fa469f77c8.png - f597c3af3fa7df7db8173f5fdcf36cf6fa74ab7660dedf7ed440927014eaac09
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 64ba7002acc8ce344f424292f5e510e13caa56779667d22e0c07ce904a87bf18
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/skout/mBVl/~3/A3Ryygt5BCM/uplcv?utm_term=how+to+use+tascam+dp-008ex
http://alimentosldm.com/userfiles/file/13773415717.pdf
http://jagatjyotischool.org/jagatjyotischool/userfiles/file/10744699010.pdf
http://www.rec39.ru/wp-content/plugins/super-forms/uploads/php/files/ac8da552a29146e2ddc66b6599eff34d/67510100546.pdf
https://www.ferienhof-schneider.de/wp-content/plugins/formcraft/file-upload/server/content/files/160703679ebef7---lerezu.pdf
https://ayurmitra.com/files/file/josaki.pdf
http://consoles-a-gagner.com/fckeditor/userfiles/file/lisikadavafubilotukekipax.pdf
http://www.expertnutritionadvisor.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a4979b6f8c7---9836216632.pdf
https://sharidendesignasphalt.com/wp-content/plugins/super-forms/uploads/php/files/a70e0304d2bf61e06c31cbdc77cbb45d/6531396362.pdf
http://www.naturapreserved.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c6ad7e93af1---99459863180.pdf
https://ecoledesgourmets.com/userfiles/file/divuzegelubanimigodafejo.pdf
https://acrgruppe.de/userfiles/file/loperagugev.pdf
http://f-okinawa.com/img/tmp/file/wisofofowurotumerokafikom.pdf
https://yarsan.ru/wp-content/plugins/super-forms/uploads/php/files/bed51ebf4ad24cfaf2e7dad08cd8dc44/3973323317.pdf
http://yuanyoujie.vip/userfiles/file/wolejapi.pdf
http://www.linkkorea.co.kr/wp-content/plugins/formcraft/file-upload/server/content/files/160d8230bd27db---16215322482.pdf
https://kme.pl/global/app/webroot/uploads/file/16280679226389.pdf
https://www.web2business.pt/wp-content/plugins/formcraft/file-upload/server/content/files/160e88c605ff54---69745898038.pdf
http://au-coeur-du-temps.com/userfiles/file/gimodajepefa.pdf
http://tayles.com/uploaded/pijowosif.pdf
https://www.poolsrus.com.au/application/third_party/ckfinder/userfiles/files/93485262930.pdf
https://miamiuniquelimo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160afb5e09d81b---59692009331.pdf
http://autovoda.ru/upload/files/zipazijosiriwale.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/

Embedded domains

feedproxy.google.com
alimentosldm.com
jagatjyotischool.org
www.rec39.ru
www.ferienhof-schneider.de
ayurmitra.com
consoles-a-gagner.com
www.expertnutritionadvisor.com
sharidendesignasphalt.com
www.naturapreserved.com
ecoledesgourmets.com
acrgruppe.de
f-okinawa.com
yarsan.ru
yuanyoujie.vip
www.linkkorea.co.kr
kme.pl
au-coeur-du-temps.com
tayles.com
www.poolsrus.com.au
miamiuniquelimo.com
autovoda.ru
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

4.150.223.113
57.155.104.224
52.123.252.202
52.110.12.46
4.230.171.124
125.56.205.106
74.178.240.51
135.232.92.137
40.99.133.242
52.123.129.14
13.69.116.105
72.153.5.139
203.26.79.13
51.132.193.105
4.209.250.170
104.46.162.231
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report