MALICIOUS — 81f9588b5d526725d3ff96c1a85687cae3193ca6cab317e11c90555806b94388

MALICIOUS — 81f9588b5d526725d3ff96c1a85687cae3193ca6cab317e11c90555806b94388 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 81f9588b5d526725d3ff96c1a85687cae3193ca6cab317e11c90555806b94388
SHA-1: 63c33f7c1b98d4fe77b771d17f75bc5c18da3d74
MD5: 4963a75d5e15f00947c07bfdfbd5e896
ssdeep: 1536:G/Qr7dvyUhkVDRE90hVi4i59lTV9Zih31V1W8pOGH39/JGvIWBaGAddWNg8dh+k/:3PlhkNGN4i59lTV9ZAFCGX9BGvRra6g+
TLSH: T1B438D1F36297DD8C7B8B4F031DAA1268604AE6C41262ED6011C8757CD1BCABFBF14960
Submitted as: 81f9588b5d526725d3ff96c1a85687cae3193ca6cab317e11c90555806b94388
File type: pdf · Size: 82069 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://inter-travel.hu/_user/file/9702052892.pdf - network signal, weight 0.70, confidence 0.80
Contacted 17 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://inter-travel.hu/_user/file/9702052892.pdf, http://nenayu.com/filespath/files/20210923111144.pdf, https://sandalyecenneti.com/wp-content/plugins/super-forms/uploads/php/files/aktt12sr5ha6icf4oougsp0drq/risovozoki.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (17 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9657 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787839846&P2=404&P3=2&P4=SpDgrjVlEEAwL8PAmd153oaO63QAPAr7xbyHMfCkaogQgIS%2blSXsB1wuj2gpdBbytsnk2Amgw6a30qSapkpP1A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787839856&P2=404&P3=2&P4=JTDO%2f%2bd2swak9H0XII9Om6U8jv0KZCbQ4Sb76kaYo2LmKpp0VeMTyTMSjG3QI%2b9nl%2b2vnUwSa7tjSZL8%2fwNPVA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\032d9883a844477379937dabfaff1373.png - b62407421e9240b10964d613681a5717926ef8c52407ca76ce266791a47dc9d4
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - afe6540d91628b9fabfd77c9c17d77881077215e28bf53cba581c160844b3231
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

http://feedproxy.google.com/~r/MbOu/~3/cmwvf4RlXg4/uplcv?utm_term=free+event+planning+spreadsheet+template
http://inter-travel.hu/_user/file/9702052892.pdf
http://nenayu.com/filespath/files/20210923111144.pdf
https://sandalyecenneti.com/wp-content/plugins/super-forms/uploads/php/files/aktt12sr5ha6icf4oougsp0drq/risovozoki.pdf
http://0vote.com/ckfinder/files/rakapijo.pdf
http://gibkrakow.pl/uploads/files/58523809477.pdf
https://www.hotel-restaurant-plainfaing.fr/ckfinder/userfiles/files/nizuxeladuwiwilodivevi.pdf
http://www.platformliften.info/wp-content/plugins/formcraft/file-upload/server/content/files/16153639e7b109---ximuvaj.pdf
https://thehideawayresortpattaya.com/userfiles/files/tifonubeviwe.pdf
http://gns3.swiz.eu/files/editor/nidom.pdf
http://chiron-ventures.com/chiron/home/img/upload/files/210905142051625654gwktx.pdf
https://gmt-tw.com/app/webroot/userfiles/files/29371846513.pdf
https://dolaodong.com/userfiles/file/deliwutut.pdf
https://artofsurfing.com/preview/ckfinder/userfiles/files/ledokizilabuluvulipoxa.pdf
http://julianina.de/upload/file/21201632733.pdf
http://pebyte.com/wp-content/plugins/super-forms/uploads/php/files/bp7pq9a0bgqdoicu3bjp0gr9dn/94312012781.pdf
https://fiscconsulting.com/userfiles/file/ragevakinejeratezapi.pdf
https://laznia-radom.pl/userfiles/file/31974131216.pdf
https://bokseinstituttet.dk/wp-content/plugins/formcraft/file-upload/server/content/files/16147cf44ed5b8---55241758395.pdf
https://kawanmto.net/contents/files/47760082714.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/

Embedded domains

feedproxy.google.com
nenayu.com
sandalyecenneti.com
0vote.com
gibkrakow.pl
www.hotel-restaurant-plainfaing.fr
www.platformliften.info
thehideawayresortpattaya.com
gns3.swiz.eu
chiron-ventures.com
gmt-tw.com
dolaodong.com
artofsurfing.com
julianina.de
pebyte.com
fiscconsulting.com
laznia-radom.pl
kawanmto.net
www.w3.org
purl.org
ns.adobe.com
inter-travel.hu
bokseinstituttet.dk

Embedded IP addresses

74.178.76.44
172.66.2.5
52.110.12.50
72.154.7.106
203.26.79.13
135.233.95.144
4.230.171.124
40.84.85.40
4.150.223.110
52.230.60.54
74.179.77.204
52.123.128.14
40.99.134.2
4.150.223.96
135.234.160.245
172.175.111.170
40.79.163.155

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report