MALICIOUS — segomitat.pdf

MALICIOUS — segomitat.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100). 5 of 50 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: 8b17dcdc8b3bb17f50dd5de35939720ba48c5c176e93546837083e10c967d2a9
• SHA-1: 07e4d5580a4ba8de6638819e0154eee5f741e677
• MD5: 16b78416f6afd63a02595a5a5f21ee6a
• ssdeep: 1536:5LmD7yzBOgjZJTWoEY/s02PGRwsRhl4Yo9vRZhd7KCB7:M3yzBOeT3zk0pJl4vvzhd7KS
• TLSH: T1E237C0F3607BDE0CBA9B6B03BEBB157D1589C6C926328B50404C763DC5B86DE2E50A11
• Submitted as: segomitat.pdf
• File type: pdf · Size: 72108 bytes
• Verdict: malicious (97/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!16B78416F6AF
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1112
• T1105
• T1566.002

Why this verdict

The malicious score of 97/100 is the fusion of 8 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4449170/normal_5fcd353b57e17.pdf - network signal, weight 0.70, confidence 0.80
• Embedded network infrastructure: https://jumiwimov.ru/wb?keyword=aci%20detailing%20manual%202018%20pdf, http://vepunip.rf.gd/graphic_design_training_manual.pdf, https://cdn.sqhk.co/dimasemi/hagtje8/free_printable_math_worksheets_7th_grade.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Contacted 10 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (15 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9654 behavior events · 1 ATT&CK techniques · 3 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• searchapp.bundleassets.example
• staging.to-do.officeppe.com
• desktop-hsgcbep._dosvc._tcp.local
• desktop-hsgcbep
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 250.255.255.239.in-addr.arpa
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• 192.168.122.115
• 23.40.52.85
• 23.11.37.157
• 20.190.167.64

Dropped files

• /opt/CAPEv2/storage/analyses/38556/files/616c21aa3d4a50e09fa88fd83a5d630f73ca2085d5c1e2f6f9436ebe6aac7f83 - 616c21aa3d4a50e09fa88fd83a5d630f73ca2085d5c1e2f6f9436ebe6aac7f83
• /opt/CAPEv2/storage/analyses/38556/files/9c7ab9ed7df294af990522b01784d800ee775aa9381041bd277692a13623ca80 - 9c7ab9ed7df294af990522b01784d800ee775aa9381041bd277692a13623ca80
• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://jumiwimov.ru/wb?keyword=aci%20detailing%20manual%202018%20pdf
• http://vepunip.rf.gd/graphic_design_training_manual.pdf
• https://cdn.sqhk.co/dimasemi/hagtje8/free_printable_math_worksheets_7th_grade.pdf
• https://s3.amazonaws.com/fukepez/76138107953.pdf
• https://static.s123-cdn-static.com/uploads/4449170/normal_5fcd353b57e17.pdf
• https://cdn.sqhk.co/duponetix/XFXjbgI/best_chess_openings_for_professionals.pdf
• http://xogosedo.iblogger.org/34107104982.pdf
• https://cdn-cms.f-static.net/uploads/4373769/normal_601d4b4ea111d.pdf
• https://static.s123-cdn-static.com/uploads/4420020/normal_5fe5594ba576b.pdf
• http://borovob.epizy.com/health_promotion_board_exercise_guidelines.pdf
• https://s3.amazonaws.com/takateg/17168872241.pdf
• http://fuxefav.epizy.com/extravaganzalorious_sheet_music.pdf
• https://s3.amazonaws.com/lanaladu/2503357269.pdf
• https://s3.amazonaws.com/zuguvoxoki/what_are_the_goals_of_punishment_sentencing.pdf
• https://cdn.sqhk.co/wumigapinido/gU3ujha/battle_strikers_starter_pack.pdf
• http://mujuwowewo.22web.org/how_to_make_expository_text.pdf
• https://static.s123-cdn-static.com/uploads/4457861/normal_5fe2bbd363647.pdf
• https://s3.amazonaws.com/tezofuretejom/nuvunozapikokozidada.pdf
• http://wafubarig.epizy.com/green_lantern_2_movie.pdf
• http://luxixeg.epizy.com/black_hole_image_vu_duo.pdf
• https://cdn-cms.f-static.net/uploads/4382629/normal_5fe7758196095.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/

Embedded domains

• jumiwimov.ru
• cdn.sqhk.co
• s3.amazonaws.com
• static.s123-cdn-static.com
• xogosedo.iblogger.org
• cdn-cms.f-static.net
• borovob.epizy.com
• fuxefav.epizy.com
• mujuwowewo.22web.org
• wafubarig.epizy.com
• luxixeg.epizy.com
• www.w3.org
• purl.org
• ns.adobe.com
• vepunip.rf.gd

Embedded IP addresses

• 20.42.65.90
• 52.230.59.222
• 74.178.232.29
• 52.110.12.28
• 135.233.45.222
• 4.230.171.124
• 135.233.95.144
• 4.150.223.105
• 162.159.36.2
• 203.26.79.13

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report