MALICIOUS — 78ba715d2f8325d3e9b99b46dcf14e033e0341230ffb5afb9ef78be0200c1772

MALICIOUS — 78ba715d2f8325d3e9b99b46dcf14e033e0341230ffb5afb9ef78be0200c1772 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 78ba715d2f8325d3e9b99b46dcf14e033e0341230ffb5afb9ef78be0200c1772
SHA-1: 55afde976f04bb58726fd5fba04c579e14909b10
MD5: d0ffe73e8c79f4a74fe175fe70f90889
ssdeep: 1536:nPwuSPxUuHCxgecBDX11rFhMpJ5S3tnQ9popwx/JG+5a2BNA:fkUI/DFZMpJ5S3+pOwx/Paf
TLSH: T19C37DFF3905BED0CBB479F436AAA256D2106CAC862B1DB940884EE7CD0B87BD7F10511
Submitted as: 78ba715d2f8325d3e9b99b46dcf14e033e0341230ffb5afb9ef78be0200c1772
File type: pdf · Size: 74791 bytes
Verdict: malicious (98/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!D0FFE73E8C79
Kaspersky (KVRT): HEUR:Hoax.PDF.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://uploads.strikinglycdn.com/files/6fbe55be-e4c1-47e6-b37d-a38ec9daada3/69538288678.pdf - network signal, weight 0.70, confidence 0.80
Contacted 23 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://resalured.ru/strik?utm_term=how+to+contact+brandon+sanderson, https://7a48fde5-f9d1-4ce4-84a2-8b156d245d18.filesusr.com/ugd/8127dd_65e8e84726d9440b8a096c4a8dcf855e.pdf?index=true, https://cdn-cms.f-static.net/uploads/4448100/normal_6009f7ba58e29.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9674 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
ntp.ubuntu.com
desktop-hsgcbep
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 5beb87d88058f88dab526307cbe2584e312b2b30eb1c926746501c147e3a3851
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\d277b1e0cd16986393736a6a2e1bdc66.png - 20ce7297c607e9a46db27cb1152e75ea6bdf93db4631c5ff24a4111be32bed16
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://resalured.ru/strik?utm_term=how+to+contact+brandon+sanderson
https://7a48fde5-f9d1-4ce4-84a2-8b156d245d18.filesusr.com/ugd/8127dd_65e8e84726d9440b8a096c4a8dcf855e.pdf?index=true
https://cdn-cms.f-static.net/uploads/4448100/normal_6009f7ba58e29.pdf
http://sisumosunozudot.epizy.com/coloring_pages_animals.pdf
http://vofofoduwegakuv.rf.gd/62046416509.pdf
https://5f384421-c3d0-4b4c-85a6-d3745974446f.filesusr.com/ugd/40006b_80deed151f7046b7af8e44c365fe47e3.pdf?index=true
https://s3.amazonaws.com/vokeri/17196980005.pdf
http://weverikovufom.rf.gd/waste_to_energy_technologies_and_global_applications.pdf
https://cdn-cms.f-static.net/uploads/4418556/normal_601bd1cc06202.pdf
https://uploads.strikinglycdn.com/files/c1fea017-fd09-48df-983d-e1dfbd0899e2/11996836841.pdf
https://uploads.strikinglycdn.com/files/6fbe55be-e4c1-47e6-b37d-a38ec9daada3/69538288678.pdf
https://s3.amazonaws.com/vososasoxumete/5655650657.pdf
http://romipozaxijida.rf.gd/70486877074.pdf
https://s3.amazonaws.com/dagasopones/how_to_find_unit_cell.pdf
https://7e6b698e-d56f-4a21-8c48-787e2f6d39f4.filesusr.com/ugd/7836c9_e9ca7fc4664b4196a27d3ca60adb2faa.pdf?index=true
http://puvusevakap.epizy.com/super_nintendo_emulator_iphone.pdf
http://xemalulixa.rf.gd/my_kindle_is_not_charging_fully.pdf
https://1d812fcc-cfc3-4558-a870-56fc5b7f4c2e.filesusr.com/ugd/754d94_3eec7704c20049e0a4de0ed6a6872e37.pdf?index=true
http://zelubosomud.rf.gd/verizon_fios_router_red_light.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

resalured.ru
7a48fde5-f9d1-4ce4-84a2-8b156d245d18.filesusr.com
cdn-cms.f-static.net
sisumosunozudot.epizy.com
5f384421-c3d0-4b4c-85a6-d3745974446f.filesusr.com
s3.amazonaws.com
uploads.strikinglycdn.com
7e6b698e-d56f-4a21-8c48-787e2f6d39f4.filesusr.com
puvusevakap.epizy.com
1d812fcc-cfc3-4558-a870-56fc5b7f4c2e.filesusr.com
www.w3.org
purl.org
ns.adobe.com
vofofoduwegakuv.rf.gd
weverikovufom.rf.gd
romipozaxijida.rf.gd
xemalulixa.rf.gd
zelubosomud.rf.gd

Embedded IP addresses

20.50.201.200
52.168.112.67
20.42.65.90
172.215.188.232
40.84.97.4
52.182.141.63
52.123.252.204
85.210.193.152
4.230.171.124
52.123.252.203
135.233.95.80
203.26.79.13
135.233.95.135
20.112.250.133
20.165.94.63
52.123.128.14
40.104.4.2
52.123.252.234
135.234.160.245
4.150.223.104
92.223.78.30
20.50.201.201
20.184.175.15

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report