MALICIOUS — 61764112735.pdf

MALICIOUS — 61764112735.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100). 5 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 76ae1520665e1c83a4be54f5896fe99da6a2a6818594b005e775fdfbb425ca6c
SHA-1: cb208ca17b395177f0b760f40d89def0005882f9
MD5: 23e4e1d7c070ee1abd7e3b56f6038728
ssdeep: 1536:qdbIeFoAlfz8JH84p8/PtFtrvS6hJpVm+XoILKahd58KI5Vcw:objWAlij8NFNJpg+XoIL3d2v5N
TLSH: T19438D0F350C7DC8C7ECBAB535DFA080C904AC6496171DA6455C87A6CC4BC3BD6E00AA2
Submitted as: 61764112735.pdf
File type: pdf · Size: 77696 bytes
Verdict: malicious (95/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!23E4E1D7C070
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 95/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 24 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://queure.ru/uplcv?utm_term=standchen+sheet+music+pdf, https://misionesmedellin2030.com/wp-content/plugins/super-forms/uploads/php/files/6nq8tnneh2pn3nq2sucl6ufoih/74904360711.pdf, https://amenagementsoleil.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c1be19ddebd---20993613497.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (17 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9672 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
desktop-hsgcbep
ntp.ubuntu.com
desktop-hsgcbep._dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\a28af9392234156429a79609b4b5e018.png - 114139be860c9c60bb170a4453c3047f80f0c179bd1999357706bde85affb4bc
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - edfc31f7aa26324a7d3b99b2303fcbc0991292fde7af8026fd4ba533f9e31f0c
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://queure.ru/uplcv?utm_term=standchen+sheet+music+pdf
https://misionesmedellin2030.com/wp-content/plugins/super-forms/uploads/php/files/6nq8tnneh2pn3nq2sucl6ufoih/74904360711.pdf
https://amenagementsoleil.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c1be19ddebd---20993613497.pdf
https://sonarmusic.hu/up_image/file/2032561300.pdf
https://miamivanservice.net/wp-content/plugins/formcraft/file-upload/server/content/files/160b2001283cba---bonaxuzozebizolumizevevu.pdf
http://dirabrealtors.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608e8f129804a---93521049447.pdf
https://alihuata.com/userfiles/file/muzuxob.pdf
https://indacphuc.com/wp-content/plugins/super-forms/uploads/php/files/i2ml8itgl26aij00tlbevne9p0/xonomexekit.pdf
https://mattweidnerlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a779a6adda5---ronuzoguririrulemap.pdf
https://www.advids.io/wp-content/plugins/formcraft/file-upload/server/content/files/160836108a3c61---jugovitivoderidib.pdf
http://macautemple.com/userfiles/file/lavepogi.pdf
http://perfectthesale.com/wp-content/plugins/formcraft/file-upload/server/content/files/160722e4f5d807---35926087879.pdf
https://bursaceviritercume.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a9f1cfda7f4---salefisasesapikabez.pdf
https://christembassybarking.org/wp-content/plugins/super-forms/uploads/php/files/1c934559a78214f9f07a2927663710ce/lusuvesoxasovob.pdf
http://bestbuyfromindia.com/userfiles/file/23551725273.pdf
https://halobysciton.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609cb03d83859---47275037914.pdf
https://adbetelparaguay.com/wp-content/plugins/super-forms/uploads/php/files/e786841bd7db67233ad5a81824820caf/lopalobabifipitoduwofu.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Embedded domains

queure.ru
misionesmedellin2030.com
amenagementsoleil.com
miamivanservice.net
dirabrealtors.com
alihuata.com
indacphuc.com
mattweidnerlaw.com
www.advids.io
macautemple.com
perfectthesale.com
bursaceviritercume.com
christembassybarking.org
bestbuyfromindia.com
halobysciton.com
adbetelparaguay.com
www.w3.org
purl.org
ns.adobe.com
sonarmusic.hu

Embedded IP addresses

74.178.76.128
135.234.160.246
135.232.92.34
172.172.255.217
72.145.35.99
51.116.253.170
48.211.4.16
4.150.223.110
52.123.252.227
52.253.84.76
4.230.171.124
20.42.179.204
74.178.240.51
20.76.201.171
74.179.77.204
40.99.134.18
52.123.128.14
40.103.64.226
135.234.160.244
72.145.35.103
203.26.79.13
92.223.78.30
104.208.16.94
172.217.25.195

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report