MALICIOUS — 7d0f738b094d710bbb1442e860ed094f0bdaa7d39fa4b82d25efbb12fcedaaea

MALICIOUS — 7d0f738b094d710bbb1442e860ed094f0bdaa7d39fa4b82d25efbb12fcedaaea is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 7d0f738b094d710bbb1442e860ed094f0bdaa7d39fa4b82d25efbb12fcedaaea
• SHA-1: e3b22874255a88f0ebc5246ba1dc188a8d8da15a
• MD5: 718279257b296d615ef573922520e331
• ssdeep: 1536:+twki5cXqnXnJjZ/dvwFikuOPbo/fWjscSpfo6ygONYaZ:Aw/nJjvvp5OPbowqhyggZ
• TLSH: T1D238D0F762C7CD8C36DB6F436F9A6118604AE788A036D7544084B6FCD8786BC2F10A52
• Submitted as: 7d0f738b094d710bbb1442e860ed094f0bdaa7d39fa4b82d25efbb12fcedaaea
• File type: pdf · Size: 76674 bytes
• Verdict: malicious (96/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!718279257B29
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1105
• T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Contacted 17 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
• Embedded link rated suspicious by URL analysis: http://www.recetasyconsejos.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607bb2f397a22---94001778825.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://medvor.ru/uplcv?utm_term=wwe2k16+game+download+for+android, https://sarujiovalente.com/wp-content/plugins/super-forms/uploads/php/files/4v3t1kcpb11f43agaooi94mv28/29986939482.pdf, http://chinasoftcore.com/userfiles/file/%5C/sugalukatikikokapat.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9798 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• ntp.ubuntu.com
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 250.255.255.239.in-addr.arpa
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

• C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 6a46489acb90143ddb14074c9d04d4c4dacf2d552637b6b122cd8edacfebab0c
• C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\f624967d10efac91257f320a84e12250.png - a6746fb08ca4dbad97a698215cb95ff9ca0d9b91adab43332f1dbbdccf740cdd
• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://medvor.ru/uplcv?utm_term=wwe2k16+game+download+for+android
• https://sarujiovalente.com/wp-content/plugins/super-forms/uploads/php/files/4v3t1kcpb11f43agaooi94mv28/29986939482.pdf
• http://chinasoftcore.com/userfiles/file/%5C/sugalukatikikokapat.pdf
• http://www.luminicaambiental.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083a95698fba---momuge.pdf
• http://www.recetasyconsejos.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607bb2f397a22---94001778825.pdf
• http://allegroescrow.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a7c480e4965---xadijulet.pdf
• http://namngonviet.vn/user-/files/lujulumaxa.pdf
• http://www.saraviation.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608232ccbd163---94921390804.pdf
• https://www.indee-r.fr/wp-content/plugins/super-forms/uploads/php/files/c2b5ac466dba21ce10acb4fc981b2784/58522386428.pdf
• https://sharzh-ufa.ru/wp-content/plugins/super-forms/uploads/php/files/18a4efb5137777b72d66df799a3f9186/61993295339.pdf
• https://www.ciabrini-immobilier.com/wp-content/plugins/super-forms/uploads/php/files/718mo7hjn82smb9af77mh6d8j7/10955168431.pdf
• http://www.realisthotel.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608f47d23a60a---dujegerezez.pdf
• https://www.marbelitesa.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/16081899e373ff---jaxojasikigelavufo.pdf
• http://krindustria.com.br/site/wp-content/plugins/formcraft/file-upload/server/content/files/160b40e0ead62a---ragikijevunokoredemipix.pdf
• https://www.nrlandscapes.co.uk/wp-content/plugins/super-forms/uploads/php/files/fe6556ca6a1747f99efc07cc8a5e1bb3/rabinojebafulasoba.pdf
• https://borderpak.com/wp-content/plugins/super-forms/uploads/php/files/b7ae2361f24eaa01d162937391b60e66/sugavigupigen.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• medvor.ru
• sarujiovalente.com
• chinasoftcore.com
• www.luminicaambiental.com
• www.recetasyconsejos.com
• allegroescrow.com
• www.saraviation.com
• www.indee-r.fr
• sharzh-ufa.ru
• www.ciabrini-immobilier.com
• www.realisthotel.com
• www.marbelitesa.co.za
• krindustria.com.br
• www.nrlandscapes.co.uk
• borderpak.com
• www.w3.org
• purl.org
• ns.adobe.com
• namngonviet.vn

Embedded IP addresses

• 172.172.255.218
• 172.66.2.5
• 20.184.175.17
• 52.123.252.242
• 52.253.84.76
• 52.110.12.44
• 4.230.171.124
• 74.178.232.29
• 203.26.79.13
• 74.178.240.51
• 74.179.77.204
• 52.123.129.14
• 52.123.252.215
• 135.233.45.222
• 48.200.63.27
• 20.184.175.11
• 20.42.73.25

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report