MALICIOUS — 7c66917ff13d6b82f8c570304d00529151d5ffee0fa3b363eef446570488e8a9

MALICIOUS — 7c66917ff13d6b82f8c570304d00529151d5ffee0fa3b363eef446570488e8a9 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 7c66917ff13d6b82f8c570304d00529151d5ffee0fa3b363eef446570488e8a9
SHA-1: c377bacf84b2a398bbfa2e4043269ed2a9474495
MD5: d6dc1b9b912fa3a35969962cac153f41
ssdeep: 1536:cr+jeuhLfUHg9CpWpV3VgK0gqJU3b5V65DlpWypOlLzNbNWntucrWfKC6Birj0:G+SuhLfUHoUWbmZ63bn65DlSlLZktuch
TLSH: T19C37BFF3619BDD4CBB979F0359AB119CA086D64C5162DE404088E6BDC2BCAFEBF00951
Submitted as: 7c66917ff13d6b82f8c570304d00529151d5ffee0fa3b363eef446570488e8a9
File type: pdf · Size: 73986 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://kahsport.cz/userfiles/file/73766213285.pdf - network signal, weight 0.70, confidence 0.80
Contacted 15 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://detikakdeti.ru/img/file/51485861093.pdf, https://solelane.com/ckfinder/userfiles/files/nebiwatupenapufirefe.pdf, https://exlite.it/ckfinder/userfiles/files/90821097870.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9637 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787844954&P2=404&P3=2&P4=ZjrLC0GSSQ7bIJVmfU97j7LkIAPGMaelrIHN3TvHX%2bT36PsT4omUT5XBi9LbQsbOaiyp3R%2f8dWj74%2bwVIpX1vw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\376b2c01003fb9cb5dd6243c2adc4c52.png - 4c92ff034961c40fbd4fde96fa8dfa4f8ae84710d2c9afa7f13e1c28536bfcb6
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - a7dac5136c8027188ee69df725b6c86294ca733617505481efb3d574ec030a23
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/PmAiG5ZyT-k/uplcv?utm_term=cornerstone+in+the+bible
http://detikakdeti.ru/img/file/51485861093.pdf
https://solelane.com/ckfinder/userfiles/files/nebiwatupenapufirefe.pdf
https://exlite.it/ckfinder/userfiles/files/90821097870.pdf
http://slkuang.com/v15/Upload/file/2021919846576113.pdf
http://kahsport.cz/userfiles/file/73766213285.pdf
http://jingluo.net/uploadfiles/files/lurojujan.pdf
http://orikon.net/Images_upload/files/50461118067.pdf
http://mama-care.com/UserFiles/file/pixodipajajasofepomejit.pdf
http://gwardiajuvenia.pl/zdjecia/fck/file/95603251072.pdf
http://tongrentangthai.com/UserFiles/file/66013226267.pdf
http://agenziaimmobiliarecannavo.eu/userfiles/files/94785948333.pdf
http://0985028898.kad.tw/kads/ckfinder/userfiles/files/retugidinexugele.pdf
http://karinameal.com/imgdish/files/zefolilaguwaduwiwumawibim.pdf
https://www.groupe-coelho.fr/ckfinder/userfiles/files/36150891520.pdf
http://www.ecostroyservis.ru/File/kutarililupixadewixun.pdf
https://dazhonghua1688.com/ckfinder/userfiles/files/30490890973.pdf
http://liveisagenix.com/ckfinder/userfiles/files/24944646851.pdf
https://sayurhijau.com/contents/files/vapetixa.pdf
http://poetische-malerei.de/web/editor/files/7372931224.pdf
https://martensmgt.com/business_school/uploads/file/bixuzileluwuniduwik.pdf
http://tnslib.su/userfiles/files/tosite.pdf
http://digitalqwerty.com/ckfinder/userfiles/files/gufipope.pdf
http://alicekhenrylawoffice.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/88043997254.pdf
https://dodatkireklamowe.pl/web/uploads/files/mamokevujo.pdf

Embedded domains

feedproxy.google.com
detikakdeti.ru
solelane.com
exlite.it
slkuang.com
jingluo.net
orikon.net
mama-care.com
gwardiajuvenia.pl
tongrentangthai.com
agenziaimmobiliarecannavo.eu
0985028898.kad.tw
karinameal.com
www.groupe-coelho.fr
www.ecostroyservis.ru
dazhonghua1688.com
liveisagenix.com
sayurhijau.com
poetische-malerei.de
martensmgt.com
tnslib.su
digitalqwerty.com
alicekhenrylawoffice.com
dodatkireklamowe.pl
jainfarms.com

Embedded IP addresses

52.123.252.224
20.184.175.9
85.210.193.152
4.230.171.124
52.253.84.76
74.178.76.44
72.145.35.105
74.179.77.164
203.26.79.13
74.178.76.128
40.99.133.210
52.123.128.14
92.223.78.30
172.170.180.133
52.168.117.174

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report