MALICIOUS — 812413b060083a0544a8fe77101e4778a15e2f7174cf8fa7786f776cc9c44727

MALICIOUS — 812413b060083a0544a8fe77101e4778a15e2f7174cf8fa7786f776cc9c44727 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 812413b060083a0544a8fe77101e4778a15e2f7174cf8fa7786f776cc9c44727
SHA-1: ba57a50ffb6bec644173130d350e17395f36dd6f
MD5: 574b1699d9569b50aa8895fdc7ca8e27
ssdeep: 1536:G1b3kx9lCzdMhfF+10BzUQu+X9KHBhlwvNZ8YXdr+6WvOnkH97HNJzIlW8pO+R0O:0zkxhh/YQu2KHTKvZNrDkd7HNO0+6nO
TLSH: T1D238D0F350D7DD4CB78B9B4769BA256DA08BD3C82263EE5014C4B66C84BC5BCBB01A50
Submitted as: 812413b060083a0544a8fe77101e4778a15e2f7174cf8fa7786f776cc9c44727
File type: pdf · Size: 83372 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://gyndoktors.de/ckfinder/userfiles/files/pukogaget.pdf - network signal, weight 0.70, confidence 0.80
Contacted 17 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://irlanc.ru/uplcv?utm_term=one+eye+more+blurry+than+the+other, http://bagandpack.ru/wp-content/plugins/super-forms/uploads/php/files/1f234453865733c5d32dd4eb89e52e14/38271134734.pdf, https://www.davidcosz.de/wp-content/plugins/super-forms/uploads/php/files/70klh3kjivdrj4d768a5nspbm3/85431539441.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9617 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\e3489bef33fcc2109364188fc2f4a479.png - 43fe3ee43844a8cb5b0d7d615ba003f66cf30af82049342a0de862cc19e29449
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - c7003aa56cb3815a275b62fdc3640757b589a08b3c84ae805322502b3644717e
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://irlanc.ru/uplcv?utm_term=one+eye+more+blurry+than+the+other
http://bagandpack.ru/wp-content/plugins/super-forms/uploads/php/files/1f234453865733c5d32dd4eb89e52e14/38271134734.pdf
https://www.davidcosz.de/wp-content/plugins/super-forms/uploads/php/files/70klh3kjivdrj4d768a5nspbm3/85431539441.pdf
http://ccswcd.com/userfiles/file/3913638173.pdf
http://kruengrangthai.com/files/files/zigewuwerusovaf.pdf
http://gyndoktors.de/ckfinder/userfiles/files/pukogaget.pdf
http://albergocavour.com/userfiles/files/turakinaviponaxexowawa.pdf
http://ubytovani-budejovice.cz/picture/vtextu/file/gimijewedofewuf.pdf
http://turar-mussin.com/userfiles/File/40421321078.pdf
https://ispartaprefabrik.com/ckfinder/upload/files/70399058871.pdf
http://saowaneecamp.com/UserFiles/file/94200316273.pdf
https://mywayrtk.com/userfiles/file/6861824647.pdf
http://www.hj-bouwt.be/wp-content/plugins/formcraft/file-upload/server/content/files/1615a66a1cca86---68439652184.pdf
http://www.trimbleexpress.sk/wp-content/plugins/formcraft/file-upload/server/content/files/16133dfb09b223---wasibizoxox.pdf
http://tanabuauto.com/js/upload/files/suvubokoxofibateko.pdf
https://isosklo.cz/uploads/13541473921.pdf
http://dsraxys.com/uploads/xakigojurefuwigara.pdf
https://perfecthospital.net/FCKeditor/file/88151952379.pdf
http://rowerowaszkola.pl/imgturysta/files/45672932925.pdf
http://www.aamuhsv-madisonalumni.org/files/files/ruwutid.pdf
http://www.timtransportes.com/home/wp-content/plugins/formcraft/file-upload/server/content/files/1613d8ad4db163---15603711874.pdf
https://myparrotfood.com/user_files/files/8441425384.pdf
http://belniig.by/public/file/muzodakov.pdf
https://sananselmo.com/wysiwygfiles/file/39793188245.pdf
http://kleinschadenexpert.com/userfiles/file/21735165950.pdf

Embedded domains

irlanc.ru
bagandpack.ru
www.davidcosz.de
ccswcd.com
kruengrangthai.com
gyndoktors.de
albergocavour.com
turar-mussin.com
ispartaprefabrik.com
saowaneecamp.com
mywayrtk.com
www.hj-bouwt.be
tanabuauto.com
dsraxys.com
perfecthospital.net
rowerowaszkola.pl
www.aamuhsv-madisonalumni.org
www.timtransportes.com
myparrotfood.com
sananselmo.com
kleinschadenexpert.com
dastone.ru
pluckywize.com
www.w3.org
purl.org

Embedded IP addresses

52.123.252.212
85.210.196.11
52.110.12.8
4.230.171.124
4.144.132.114
135.233.95.144
135.232.92.97
20.76.201.171
52.123.128.14
40.104.4.2
172.178.240.161
52.123.252.204
72.145.35.105
203.26.79.13
52.123.252.240
172.215.188.225
48.192.143.121

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report