MALICIOUS — 808ff296788fe5966779bc319c577e3881fe804cffcdda9e3dc5b16afec91a0f

MALICIOUS — 808ff296788fe5966779bc319c577e3881fe804cffcdda9e3dc5b16afec91a0f is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 808ff296788fe5966779bc319c577e3881fe804cffcdda9e3dc5b16afec91a0f
SHA-1: b0dc0c60ab7890f6fce1f3a0566d704430b454a2
MD5: 0c9aa31cbce666c8a1df159192225fb7
ssdeep: 1536:zYzvtlAjsVeXftVOkOAI06wgUqj82WIgp1ZpEuyQD+K7in12nWspO2xmSm:cnMPt1LDuUhW8vp9yQD+Iika2wD
TLSH: T12437BFF3518BDE4C361FDB036DF752A95149E7886962EFA050C4BB6C847CA6CBE10A01
Submitted as: 808ff296788fe5966779bc319c577e3881fe804cffcdda9e3dc5b16afec91a0f
File type: pdf · Size: 76159 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://legalinet.eu/userfiles/files/rugadalulefipig.pdf - network signal, weight 0.70, confidence 0.80
Contacted 20 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://infrive.ru/uplcv?utm_term=underwater+architecture+pdf, http://tamphuhiep.com/Images_upload/files/62482062388.pdf, http://neodev.space/wp-content/plugins/formcraft/file-upload/server/content/files/16138c00b35c25---sowuwutewubop.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9617 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
250.255.255.239.in-addr.arpa
ntp.ubuntu.com
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\2b06062648c7e34a6db198b4bd705503.png - 5faf25a191bebc461ecc7adbe441f3e5fdfd3f1be4a4a2f0e2110384bb553d83
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 9ac94d4fc96f7c849215d8a8b6dabe2f14c2b6fc0b88bd2b2061cdac41fe6fb3
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://infrive.ru/uplcv?utm_term=underwater+architecture+pdf
http://tamphuhiep.com/Images_upload/files/62482062388.pdf
http://neodev.space/wp-content/plugins/formcraft/file-upload/server/content/files/16138c00b35c25---sowuwutewubop.pdf
http://legalinet.eu/userfiles/files/rugadalulefipig.pdf
http://bebelino.ru/userfiles/file/nudikumowamubekatibufub.pdf
http://zrdb-drogbud.pl/Upload/file/74450182846.pdf
http://hondatayho.vn/images/ckeditor/files/bijomumerubuziwejora.pdf
https://betonwerkendejonge.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1613264bd61675---1983092759.pdf
https://ww150007.linebot.net/upfile/files/20210903064613.pdf
http://meandnetworking.com/ckfinder/userfiles/files/foxitom.pdf
http://hoaiduc.edu.vn/ckfinder/userfiles/files/tufider.pdf
http://fratellibeninca.com/images/file/20070564150.pdf
http://patrick-vallot.com/upload/files/naxet.pdf
http://tks-forever.com/upload/2021/09/04/file/sudabopupola.pdf
http://www.oknookna.pl/wp-content/plugins/formcraft/file-upload/server/content/files/1613358bd389ce---40153287486.pdf
https://jechrina.gr/FCKeditor/userimages/file/54450175540.pdf
http://computerdoki.hu/user/file/lapumikiwewowevibadavu.pdf
http://rtm-plus.ru/ckfinder/userfiles/files/sibelowikovamabudomizabi.pdf
http://brodart01.com/wp-content/plugins/super-forms/uploads/php/files/3r5kmg9hpf24hbka5fdedtf54k/kizakeluvewupokukesapim.pdf
http://changrung.com/ckfinder/userfiles/files/jarepabaxa.pdf
https://amoslodge10-org.alljobsinliberia.com/ckfinder/userfiles/files/41625537404.pdf
https://pamukoglu.com/userfiles/file/69440133821.pdf
http://cwpni.com/userData/ebizro_board/file/41877516.pdf
https://vpmemorial.net/images/file/36325692614.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

infrive.ru
tamphuhiep.com
neodev.space
legalinet.eu
bebelino.ru
zrdb-drogbud.pl
betonwerkendejonge.nl
ww150007.linebot.net
meandnetworking.com
fratellibeninca.com
patrick-vallot.com
tks-forever.com
www.oknookna.pl
rtm-plus.ru
brodart01.com
changrung.com
amoslodge10-org.alljobsinliberia.com
pamukoglu.com
cwpni.com
vpmemorial.net
www.w3.org
purl.org
ns.adobe.com
hondatayho.vn
hoaiduc.edu.vn

Embedded IP addresses

74.178.76.128
72.145.35.105
20.184.175.5
52.123.252.247
20.247.184.197
57.154.63.210
4.230.171.124
20.165.94.46
203.26.79.13
74.178.76.54
135.232.92.137
20.236.44.162
52.123.129.14
40.99.134.18
172.178.240.163
52.182.141.63
48.199.12.1
20.42.73.27
52.168.117.171
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report