MALICIOUS — 7f7cc909ce20631c3c64e4326f1f5a5662f45e37d8f71c010538db8e3a5daf4f

MALICIOUS — 7f7cc909ce20631c3c64e4326f1f5a5662f45e37d8f71c010538db8e3a5daf4f is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 7f7cc909ce20631c3c64e4326f1f5a5662f45e37d8f71c010538db8e3a5daf4f
SHA-1: ff684ab6571483874f003f05535d07877f34e5c2
MD5: fd04681941a96afc0c0fab4ae2ad8053
ssdeep: 1536:BQn481RtkU+4RZmhBJ3Xr7hT/+EdHipDntQxICRqm4efh4WUCWI4tUdv3pbDWQp1:y481RtkuRZmJ3n5/kDtQxdAgfh0HAPp5
TLSH: T12537B0F321DBDC9C7B9A9B0776A7015CB14AE3485272EBA0048C672C84BC57DBB14E21
Submitted as: 7f7cc909ce20631c3c64e4326f1f5a5662f45e37d8f71c010538db8e3a5daf4f
File type: pdf · Size: 69917 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 19 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://ijacr.net/assets_admin/ckfinder/core/connector/php/uploads/files/setifiboxexoduvagezebosef.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://inwebjor.ru/uplcv?utm_term=donna+tartt+the+secret+history+pdf, https://messianic.live/wp-content/plugins/super-forms/uploads/php/files/22418c2a453bfbc352049b2e01175dfc/leteza.pdf, http://108shiva.com/userfiles/file/ - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9608 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
_dosvc._tcp.local
desktop-hsgcbep
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787916684&P2=404&P3=2&P4=h7Umag5x%2bjPxtAKpqlihlt4bcxQ7PkEIjWWfBZIwil2RraOyS%2bSxMpNkjoJUc4i3bqCXFjLi6uruPZXb1o6EYQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787916734&P2=404&P3=2&P4=Ftn%2b8OZZuXe4iOmddrdrYYXS0Hp5ftXu3iQUDKNELUBLD16mb3MBzcRalGplpg5r4SArY4S3UooVX1oyJKp%2fEw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\0d28e4ce844878af593edaf0749b617d.png - 027b2d448be481d24759fafe75be26a4268c0d9872b6b747644978e0c86e43a2
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - a0194747eebda4945b7873a5ba91df27cb83dfa1e7be3852a9bb9c930612476e
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://inwebjor.ru/uplcv?utm_term=donna+tartt+the+secret+history+pdf
https://messianic.live/wp-content/plugins/super-forms/uploads/php/files/22418c2a453bfbc352049b2e01175dfc/leteza.pdf
http://108shiva.com/userfiles/file/
http://pkynfe.net/userfiles/file/53817199909.pdf
http://ansatrans.ru/admin/ckfinder/userfiles/files/31724178325.pdf
https://hamzsabegi60szallo.hu/UserFiles/File/jisurolipobokunufudid.pdf
https://sunnyrosesschool.com/userfiles/file/19144517477.pdf
https://ijacr.net/assets_admin/ckfinder/core/connector/php/uploads/files/setifiboxexoduvagezebosef.pdf
http://borisovhlebprom.by/var/upload/file/xirusoxadutenap.pdf
http://saint-party.com/media/file/6074651285.pdf
https://bold-iot.com/uploads/files/202109081727068344.pdf
https://matraci.info/UserFiles/File/52780736870.pdf
http://ziconiavip.com/uploadfck/file/38566525344.pdf
https://www.auto-ecole-rive-droite.fr/ckfinder/userfiles/files/bolinagem.pdf
http://ibnuaffan.com/ckfinder/userfiles/files/fezogawepafuduvidogukugo.pdf
https://webbsoil.com/home/webb/public_html/ckfinder/userfiles/files/gorokusejudaporomepisag.pdf
http://h-n-s.net/userfiles/file/14344408454.pdf
http://osoboebludo.com/ckfinder/userfiles/files/62686487946.pdf
http://montagnobozzone.it/userfiles/files/78310708103.pdf
http://taxfreepoint.com/file/10557567027.pdf
https://regenerativetherapyforpain.com/wp-content/plugins/super-forms/uploads/php/files/1f58b53db2a824c2e735825d7006a98f/gisisodofazudobebetino.pdf
https://houstoncoinclub.org/FCKeditor/file/wemofotu.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/

Embedded domains

inwebjor.ru
messianic.live
108shiva.com
pkynfe.net
ansatrans.ru
sunnyrosesschool.com
ijacr.net
saint-party.com
bold-iot.com
matraci.info
ziconiavip.com
www.auto-ecole-rive-droite.fr
ibnuaffan.com
webbsoil.com
h-n-s.net
osoboebludo.com
montagnobozzone.it
taxfreepoint.com
regenerativetherapyforpain.com
houstoncoinclub.org
www.w3.org
purl.org
ns.adobe.com
hamzsabegi60szallo.hu
borisovhlebprom.by

Embedded IP addresses

51.11.192.51
85.210.193.152
172.172.255.218
57.154.63.210
52.110.12.15
52.110.12.2
4.230.171.124
92.223.78.30
40.84.97.4
74.178.76.128
52.123.129.14
40.103.64.226
74.179.77.204
135.232.92.34
203.26.79.13
52.123.252.230
20.184.175.3
20.184.175.10
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report