MALICIOUS — 8957d794a4700ff24ac034eafe2d5ea2c236823e6d96470fd16c9de94613dd64

MALICIOUS — 8957d794a4700ff24ac034eafe2d5ea2c236823e6d96470fd16c9de94613dd64 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 8957d794a4700ff24ac034eafe2d5ea2c236823e6d96470fd16c9de94613dd64
SHA-1: 07093ddcde660af1c0e4061233dc895ce42cc2c9
MD5: 32c22a2b7ab949990a1179002f57bcfc
ssdeep: 1536:sSM6yTOLLyktv6aOeaY6p0v19oLK9ksSFRskWkNpOPaW5iaoLQKkwZW0cAtms2hK:zMSLPnOeaY6pQoLK9ksSFRsZPGLQcZd3
TLSH: T18D38C0F361B7FDDCB64F6B0328FB01ACA549D2885162E6504488B76D917CDBD6E04902
Submitted as: 8957d794a4700ff24ac034eafe2d5ea2c236823e6d96470fd16c9de94613dd64
File type: pdf · Size: 83973 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 16 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://gallerylingard.com/uploads/file/42087013599.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: http://girc.ncue.edu.tw/ckfinder/ckfiles/files/tubirupisaranosovidi.pdf, https://gallerylingard.com/uploads/file/42087013599.pdf, http://kor-ra.ru/UserFiles/file/90049704201.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9670 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
desktop-hsgcbep._dosvc._tcp.local
ntp.ubuntu.com
_dosvc._tcp.local
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\ff084c96f4da6b97ac97194a0fedd722.png - 24ecd54d11f99979741bbc67a6b81f38c7a422544c37f1926c8888aaa53523b7
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - e1ac5fcf0a8aaab56d179c803b61092180dd36462595ce668098261ef80acf34
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/skout/mBVl/~3/BkSY9tpko7c/uplcv?utm_term=what+is+the+best+photo+collage+app+for+android
http://girc.ncue.edu.tw/ckfinder/ckfiles/files/tubirupisaranosovidi.pdf
https://gallerylingard.com/uploads/file/42087013599.pdf
http://kor-ra.ru/UserFiles/file/90049704201.pdf
https://cartolmania.it/file/lirejorujidodesudavusu.pdf
http://penzionnakrizankach.cz/ckfinder/userfiles/files/75427905390.pdf
http://tearose-kitchen.com/sites/default/files/images/imcefile/26003888755.pdf
http://queuemanagementsystems.com/wp-content/plugins/formcraft/file-upload/server/content/files/161423fccbcbbe---94694374001.pdf
https://hunghiephuylog.com/upload/files/66256114191.pdf
https://www.sevgiliyevideo.net/wp-content/plugins/formcraft/file-upload/server/content/files/16130054f17791---gewagixawod.pdf
https://danielstrehlau.com/userfiles/file/vejelabadalukebadagox.pdf
https://www.helpfulhunks.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/16130b209e24e5---solekujoxomeza.pdf
https://npkfertilizerproduction.com/d/files/31754989447.pdf
http://poliinc.com/upload/files/vibure.pdf
https://cullinanconstruction.com/wp-content/plugins/super-forms/uploads/php/files/7me4q4hdsavhbvtcmepgh89rqa/bevipajewozatajozeki.pdf
https://przyklejki.pl/userfiles/rekowuwojugurabezoboguxel.pdf
http://whuntex.ru/userfiles/file/62817089374.pdf
https://ldcpc.com/ckfinder/userfiles/files/nonitu.pdf
http://abwalabamaave.com/uploads/files/sitobob.pdf
http://www.yankey.com.tw/demo/public/editor/ckfinder/upload/user_upload/files/ropix.pdf
http://www.firengo.com/userfiles/files/xegapuzanatajixipetulo.pdf
http://tnslib.tools/userfiles/files/54384823041.pdf
http://orenprom.com/img/account/file/xopewarun.pdf
https://safarekhoob.ir/basefile/safarekhoobir/files/21886094596.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

feedproxy.google.com
girc.ncue.edu.tw
gallerylingard.com
kor-ra.ru
cartolmania.it
tearose-kitchen.com
queuemanagementsystems.com
hunghiephuylog.com
www.sevgiliyevideo.net
danielstrehlau.com
www.helpfulhunks.com.au
npkfertilizerproduction.com
poliinc.com
cullinanconstruction.com
przyklejki.pl
whuntex.ru
ldcpc.com
abwalabamaave.com
www.yankey.com.tw
www.firengo.com
orenprom.com
safarekhoob.ir
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

13.69.116.105
4.150.223.99
20.42.179.204
52.110.12.26
85.210.196.11
4.230.171.124
135.233.95.144
4.207.44.73
40.103.64.226
52.123.129.14
52.123.128.14
135.234.160.246
20.165.94.46
203.26.79.13
172.170.180.133
51.104.15.252

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report