MALICIOUS — 876b4bd233a358dae425faa3b03d890bfbb771a936d957d2ecc0dc3baae8f6dd

MALICIOUS — 876b4bd233a358dae425faa3b03d890bfbb771a936d957d2ecc0dc3baae8f6dd is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 876b4bd233a358dae425faa3b03d890bfbb771a936d957d2ecc0dc3baae8f6dd
SHA-1: 41e5fa594c75d92b071efc74b11ff0b60efd29ae
MD5: e66a5fb1230acf2c0b9ab93894d0fbc1
ssdeep: 1536:99PyxYNRGWS/EYJ1ShqTmZ+lYYfPtIBtThsWjWxaAGdAYJKoxONW8pO+C+a:rPyiXsShR+l3PGBrvsDZ4lO8+a
TLSH: T10F37BFF361D7DD5CB74B9B4379A9506D4186D7885633EE4094C8B26CC8BCA7EAE00A80
Submitted as: 876b4bd233a358dae425faa3b03d890bfbb771a936d957d2ecc0dc3baae8f6dd
File type: pdf · Size: 71978 bytes
Verdict: malicious (95/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 95/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 19 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://irlanc.ru/uplcv?utm_term=tvd+and+harry+potter+crossover, https://www.andeanskyline.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614d722f58b5c---32816269369.pdf, http://sarahscupcakery.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614b8d344ed91---61797379948.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9603 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
desktop-hsgcbep
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - b43a9603fb1ac45f81e2c2e292e965c75cd7a739ab994c016b1c5a0458fb6738
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\db0798a329c0a00ab8d4b1b3e02396a6.png - dad5a0c1f265774a236b5eb22de8f4360c9d527ea8e2643340220e66242ffe9d
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://irlanc.ru/uplcv?utm_term=tvd+and+harry+potter+crossover
https://www.andeanskyline.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614d722f58b5c---32816269369.pdf
http://sarahscupcakery.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614b8d344ed91---61797379948.pdf
https://go2germany.ru/files/file/84223099036.pdf
https://arerp.kr/data/file///60698676063.pdf
https://elsadaulte.com/ckfinder/userfiles/files/92325403151.pdf
https://rocha.pt/userfiles/file/kewafobejo.pdf
http://adhunikjewellers.com/ckfinder/userfiles/files/53203089349.pdf
http://trubaopt.ru/content/file/jugozim.pdf
https://duongthuy.net/userfiles/file/61064194854.pdf
http://qataminational.com/uploaded_files/userfiles/files/lotop.pdf
https://vandolderskb.com/images/usr/vodawasuxerarorutatazag.pdf
http://wawa757.com/uploads/files/memuzogexatorekowifub.pdf
http://retrolondontees.com/userfiles/file/2954017924.pdf
http://silver.jo/ckfinder/blanc/files/42255425254.pdf
http://abpaluso.com/upload/file/kiwupavuzitoluriv.pdf
http://globalone-mould.com/gbw/fckfiles/20210912084839.pdf
https://www.accidentinjuryalbuquerque.com/wp-content/plugins/super-forms/uploads/php/files/ih5v4iffgfm4hcl09dls37te7u/79193782424.pdf
http://www.belladermeestetica.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/161559bf6c1a76---wodazevefuraniza.pdf
http://sudeoksa.net/userfiles/file/20210901115753.pdf
https://webmodels.studio/wp-content/plugins/formcraft/file-upload/server/content/files/16132d0c92ba8b---lewog.pdf
http://gfzgt.ch/upload/file/gagafifebewofenajelesaz.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/

Embedded domains

irlanc.ru
www.andeanskyline.com
sarahscupcakery.com
go2germany.ru
arerp.kr
elsadaulte.com
adhunikjewellers.com
trubaopt.ru
duongthuy.net
qataminational.com
vandolderskb.com
wawa757.com
retrolondontees.com
abpaluso.com
globalone-mould.com
www.accidentinjuryalbuquerque.com
www.belladermeestetica.com.br
sudeoksa.net
gfzgt.ch
www.w3.org
purl.org
ns.adobe.com
rocha.pt
silver.jo
webmodels.studio

Embedded IP addresses

74.178.232.29
20.42.65.85
13.69.239.69
52.110.12.56
52.110.12.8
4.230.171.124
85.210.193.152
135.232.92.137
4.150.223.105
20.76.201.171
52.123.129.14
40.99.134.2
52.123.252.230
72.154.7.98
203.26.79.13
52.123.252.238
57.155.104.224
92.223.78.30
20.42.65.90

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report