MALICIOUS — 0a51c1_f0796f407e044497abe3744098127bd1.pdf

MALICIOUS — 0a51c1_f0796f407e044497abe3744098127bd1.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 5 of 50 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 7ac0756b3cf95bb9f6b3a89c5c38ec36e11b459e31da91ed4a07b874c1fa4bc7
SHA-1: ca15c9c2f0bb55d3b307a3be7f5a4dc1d658b01e
MD5: 49d7737b066fa301dc19be09806e6bbd
ssdeep: 1536:V9V6AHIkCI1h+GWnFlrVBnf0FSp1XVvF+dZCdzdACG9rCaSWrvfQpTsyxf:fV6AHIJchPWfVTr+dAd6NCa3rfQFsyV
TLSH: T19D38D0F3104BCD5C7A8A9F536AFB185E648DC78C643A86B08448B75D8C782FD7E12990
Submitted as: 0a51c1_f0796f407e044497abe3744098127bd1.pdf
File type: pdf · Size: 77505 bytes
Verdict: malicious (99/100)

Detections (5 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!49D7737B066F

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Lazarus): root_.cache_dconf_user - dynamic signal, weight 0.80, confidence 0.90
Embedded link rated malicious by URL analysis: https://vaturelola.weebly.com/uploads/1/3/4/7/134704713/1687624.pdf - network signal, weight 0.70, confidence 0.80
Contacted 38 external host(s) at runtime (7 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://botokaw.ru/wix?keyword=toshiba+satellite+l675d+service+manual, https://vaturelola.weebly.com/uploads/1/3/4/7/134704713/1687624.pdf, https://cdn-cms.f-static.net/uploads/4460463/normal_600c15c063d23.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9825 behavior events · 1 ATT&CK techniques · 4 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
ntp.ubuntu.com
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

/opt/CAPEv2/storage/analyses/31356/files/034f97b647974f0021f2dc9e0bf73ba505a0fd26b732d9207b93b07a015544bc - 034f97b647974f0021f2dc9e0bf73ba505a0fd26b732d9207b93b07a015544bc
/opt/CAPEv2/storage/analyses/31356/files/ad33b4f6b69646c7f135ac904b114a98094c83cb4f49d78a994f7b3519295fc4 - ad33b4f6b69646c7f135ac904b114a98094c83cb4f49d78a994f7b3519295fc4
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
tmp_tmp.jPBmvY5oIe - 9e69631f8232ffa54afb1ace19be510f9ab4e6f48b02de16fa246f55058e9954

Embedded URLs

https://botokaw.ru/wix?keyword=toshiba+satellite+l675d+service+manual
https://vaturelola.weebly.com/uploads/1/3/4/7/134704713/1687624.pdf
https://cdn-cms.f-static.net/uploads/4460463/normal_600c15c063d23.pdf
http://fojofediwesifog.rf.gd/90033922718.pdf
https://xabetibupu.weebly.com/uploads/1/3/0/7/130738966/giduvuxeka_nexadil_dudolokovikos_gotudonuxo.pdf
https://gozowejikagigu.weebly.com/uploads/1/3/5/3/135345496/bosedamikokagotukav.pdf
http://zinuginevero.22web.org/lutatiwolan.pdf
https://cdn-cms.f-static.net/uploads/4379053/normal_600a109be3986.pdf
http://judejelalub.rf.gd/mini_split_heat_pump_consumer_reports.pdf
https://static.s123-cdn-static.com/uploads/4403672/normal_5ff01eecbe70b.pdf
https://static.s123-cdn-static.com/uploads/4386829/normal_5ff9654bbaa46.pdf
https://wotapidedodibi.weebly.com/uploads/1/3/4/4/134475573/c59dd39fe.pdf
https://static.s123-cdn-static.com/uploads/4404745/normal_5ff004ad08516.pdf
http://mowojejude.22web.org/fowaverudumakalevijuxa.pdf
https://static.s123-cdn-static.com/uploads/4379374/normal_5fee63b6c8cb4.pdf
https://static.s123-cdn-static.com/uploads/4470962/normal_5fcff3dbe1405.pdf
https://gofupadosu.weebly.com/uploads/1/3/4/8/134853885/movisepuvojigewi.pdf
https://static.s123-cdn-static.com/uploads/4367922/normal_5ffa397ed1ac1.pdf
http://losojotatilo.epizy.com/14384476827.pdf
https://gagakulusete.weebly.com/uploads/1/3/5/3/135326625/4760cf.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/

Embedded domains

botokaw.ru
vaturelola.weebly.com
cdn-cms.f-static.net
xabetibupu.weebly.com
gozowejikagigu.weebly.com
zinuginevero.22web.org
static.s123-cdn-static.com
wotapidedodibi.weebly.com
mowojejude.22web.org
gofupadosu.weebly.com
losojotatilo.epizy.com
gagakulusete.weebly.com
www.w3.org
purl.org
ns.adobe.com
fojofediwesifog.rf.gd
judejelalub.rf.gd

Embedded IP addresses

125.56.205.32
52.110.12.2
52.110.12.56
4.230.171.124
40.84.85.40
20.165.94.63
20.231.239.246
52.123.129.14
40.104.4.2
40.99.133.226
20.42.65.88
72.145.35.97
203.26.79.13
52.123.252.202
135.234.160.245
48.211.4.16
20.165.94.46

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report