MALICIOUS — fanepuxizimalalav.pdf

MALICIOUS — fanepuxizimalalav.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 73eede0547aa377b633fb308eba7fb8c51df3c2eb7d3870e42fb7e8035b8339b
SHA-1: cc813725b89332d675f2060f89bcf273c4d3950d
MD5: 980a5eb5361e0a7b7dd63dec993d035f
ssdeep: 1536:46ZpCaeZi5vODKtBjLm/GQmYdEjTIowt0DGHlzC7X4LPW6pOu26WQIi7+8JXzYUX:rZDeI2DKtV6G2wTIje4lo4Lku2VOFke
TLSH: T14239D0F362CBDD4C76869F539D9E21696049D38C2262D7E09584FBBC85BC5BC7B00A20
Submitted as: fanepuxizimalalav.pdf
File type: pdf · Size: 84961 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Contacted 14 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://119pump.net/d/files/86749964585.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://allytemp.ru/uplcv?utm_term=critical+paradigm+pdf, https://svetpoznaniyaonline.ru/wp-content/plugins/super-forms/uploads/php/files/8a6733eb39d62597c0f80c1515e3ae81/9244043510.pdf, http://tuzvedo.hu/elemek/file/tesasazulizilepum.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9679 behavior events · 1 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
250.255.255.239.in-addr.arpa
255.255.254.169.in-addr.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
251.0.0.224.in-addr.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\c15917c68fa83f860b0080ccbef4968a.png - bbbd2c57909f7766516cd6d9afd7a8407c8b5372965fa81a357b6722f1bddf6f
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 82ef6b92087f9260b6896468c11af0ada56b3a529374653b6c33120b100aa04c
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://allytemp.ru/uplcv?utm_term=critical+paradigm+pdf
https://svetpoznaniyaonline.ru/wp-content/plugins/super-forms/uploads/php/files/8a6733eb39d62597c0f80c1515e3ae81/9244043510.pdf
http://tuzvedo.hu/elemek/file/tesasazulizilepum.pdf
https://moniimpex.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c4524959370---46768739516.pdf
http://pngroup.pl/ckfinder/userfiles/files/forijipesobidiwaparezoret.pdf
https://veritiesinstitute.com/wp-content/plugins/super-forms/uploads/php/files/95eaae39e8c9d206e4eaf762c64ca23b/madobiwam.pdf
http://119pump.net/d/files/86749964585.pdf
http://snookerfootball.eu/wp-content/plugins/formcraft/file-upload/server/content/files/160891564d14e1---lorese.pdf
https://sunarchegypt.com/userfiles/file/luxurusivakapifujokidawom.pdf
https://debo-fit.be/userfiles/file///76847170930.pdf
https://aedwea.com/upload/foto/53037670251.pdf
https://www.napariverinn.com/wp-content/plugins/super-forms/uploads/php/files/dd79662970a5cd39d99300dd2857a55f/23480985251.pdf
https://bindazzled.com.au/wp-content/plugins/super-forms/uploads/php/files/a5cd099201732ed64bdc7e4033872f69/nusujegavigoloverag.pdf
http://www.telsercom.com/wp-content/plugins/formcraft/file-upload/server/content/files/16104a8da4c965---85515046861.pdf
http://www.luminicaambiental.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ee4e37b24dd---49099542877.pdf
http://childconnect.com/swi/fckfiles//file/50468150206.pdf
https://theatresaucinema.fr/uploads/file/kerojagubuxoxapomibi.pdf
http://www.adanakursmerkezi.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607482f97882b---22715993340.pdf
https://jesssmithtri.com/jesssmith/ckfinder/userfiles/files/kutawexivorojanusomulirek.pdf
https://www.medipratik.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608573e672c3d---58077910536.pdf
https://duocvinhkim.com/userfiles/file/67130113577.pdf
http://e1pl2.nazwa.pl/busy/fotki/file/43993297806.pdf
http://www.nuricomuvakfi.org/wp-content/plugins/super-forms/uploads/php/files/60m34er5j7n53k0gbf2h1g0911/tufozirosepuze.pdf
http://muzeumostrowiec.pl/obrazy/file/zonepowefixozidabotidaw.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

allytemp.ru
svetpoznaniyaonline.ru
moniimpex.com
pngroup.pl
veritiesinstitute.com
119pump.net
snookerfootball.eu
sunarchegypt.com
debo-fit.be
aedwea.com
www.napariverinn.com
bindazzled.com.au
www.telsercom.com
www.luminicaambiental.com
childconnect.com
theatresaucinema.fr
www.adanakursmerkezi.com
jesssmithtri.com
www.medipratik.com
duocvinhkim.com
e1pl2.nazwa.pl
www.nuricomuvakfi.org
muzeumostrowiec.pl
www.w3.org
purl.org

Embedded IP addresses

20.42.73.24
57.155.104.224
20.247.184.142
4.230.171.124
135.233.95.135
135.233.95.144
52.123.129.14
74.179.71.159
203.26.79.13
135.234.160.245
20.42.73.31
20.89.1.8
20.42.65.91
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report