MALICIOUS — 88e758b844d9a49ea6a3dd62737ca0600a7325069adf977128eee47555dd8d01

MALICIOUS — 88e758b844d9a49ea6a3dd62737ca0600a7325069adf977128eee47555dd8d01 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 88e758b844d9a49ea6a3dd62737ca0600a7325069adf977128eee47555dd8d01
SHA-1: a20444765b324ba3b8f7d45d9bd4a7e6f26b3de6
MD5: 881abde2bd27a2305365dba232675e91
ssdeep: 1536:AJZQSyEgxcCas0Ooz8vxz/NfQHI4nDDKHVMhNTdW6pOu26W36EDlyYKHNEx:cmStgiCas0Tz8vV/NYlkuNSu2P5KQ
TLSH: T1D439C0F3A1ABDD5C7786DF0362EF216CA049EBC82162EA149088B76C447C6BD7F00951
Submitted as: 88e758b844d9a49ea6a3dd62737ca0600a7325069adf977128eee47555dd8d01
File type: pdf · Size: 84968 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://aurora-c.jp/files/files/44875458858.pdf - network signal, weight 0.70, confidence 0.80
Contacted 16 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://leadershipcareer.kr/fckeditor/_upload/file/pelumuwadesa.pdf, http://kientrucsangtrong.com/plus/files/52217890267.pdf, https://leavereview.com/customerinterview/ckfinder/userfiles/files/30999970260.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9715 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787853991&P2=404&P3=2&P4=TztPw4Sn6vdkVX8vN0MdI8%2bZRmfqMWhA9kp7uIXldbEqV7PKXYWDo593%2fiX99znFj7SViMn0zSd9Gn8AaK0Iow%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787854063&P2=404&P3=2&P4=QDA%2fI0hn%2b5X2%2fbdf7ll1phCCy13jwoIpZs5vgwLOZi6F0KeJPaPKHVOhJyt99f6N8x1%2fR7%2fy2D4g2d2T%2fhCo1A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
23.40.52.85

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - cd0eeecb842bab30a3e87f6f2de88ed0c669bb45e908b116f9c956872929d936
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\14d584aee4b83441b7351699e199d7c9.png - e98395a83be7fe2679b57c060d981eb0b6f1c029e479d8a5e87ad9a59db56dfb
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/DOqCt-cVA4I/uplcv?utm_term=best+online+war+games+for+android
http://leadershipcareer.kr/fckeditor/_upload/file/pelumuwadesa.pdf
http://kientrucsangtrong.com/plus/files/52217890267.pdf
https://leavereview.com/customerinterview/ckfinder/userfiles/files/30999970260.pdf
https://hogies.com/includes/template/uploads/file/35250161261.pdf
http://language-coach.pl/uploads/files/6203753517.pdf
https://smartech.lv/sites/smartech/uploads/documents/files/bupaburaronukizotene.pdf
https://ropaalmayoreo.com/images/userfiles/file/34172056187.pdf
http://daiichibus.vn/uploads/news_file/3655521910.pdf
http://aurora-c.jp/files/files/44875458858.pdf
https://sentinels.ro/userfiles/file/93178670551.pdf
http://ankaser.com/userfiles/file/dilujitax.pdf
https://primax.fr/wp-content/plugins/super-forms/uploads/php/files/n78r1nhnnn9v3k916ad539f364/konudataf.pdf
http://krindustria.com.br/site/wp-content/plugins/formcraft/file-upload/server/content/files/161326093df920---55619386525.pdf
https://astoriareiki.com/wp-content/plugins/super-forms/uploads/php/files/0c08793e84b249f2614a12ffde4edb00/54324984102.pdf
http://sun-marche.com/app/webroot/js/ckfinder/userfiles/files/jasagurinuxuva.pdf
http://amtusa.com/wp-content/plugins/formcraft/file-upload/server/content/files/16136f22c0f116---bopak.pdf
http://hongphuc.vn/userfiles/file/83312855016.pdf
https://kvartira-zalog.ru/wp-content/plugins/super-forms/uploads/php/files/12f5bf49f25951b648463ff1a28d8c0b/xiwojelisimozesosapek.pdf
http://emrc.ie/upload/imagecontent/file/lasedojeguragoromoxawili.pdf
http://devitohomesorlando.com/userfiles/files/fekupiju.pdf
http://frutapac.es/ckfinder/userfiles/files/5457892891.pdf
https://www.vigo.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/16139a87f1225a---dupefibosizob.pdf
http://fukaofoods.tw/uploads/files/202109171403382559.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

feedproxy.google.com
leadershipcareer.kr
kientrucsangtrong.com
leavereview.com
hogies.com
language-coach.pl
ropaalmayoreo.com
aurora-c.jp
ankaser.com
primax.fr
krindustria.com.br
astoriareiki.com
sun-marche.com
amtusa.com
kvartira-zalog.ru
devitohomesorlando.com
frutapac.es
www.vigo.co.za
fukaofoods.tw
www.w3.org
purl.org
ns.adobe.com
smartech.lv
daiichibus.vn
sentinels.ro

Embedded IP addresses

52.123.252.216
52.110.12.21
4.230.171.124
20.247.184.142
74.178.240.51
20.165.94.63
52.123.128.14
74.178.76.44
172.178.240.163
203.26.79.13
51.105.71.136
20.42.179.192
52.123.252.234
20.42.65.85
57.154.63.210
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report