MALICIOUS — 50164840856.pdf

MALICIOUS — 50164840856.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 50 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 8ce436fb253dbf6ca3c2a06ebfcc37c3f0c7da4df0e6ef2b1d0830a0c667b585
SHA-1: 597f491030e11f3eaefe92182356696532c3d817
MD5: 5902b4c29bd9083226c8e6f2538c9dcc
ssdeep: 1536:44tOQpkD/b0h2P0XGbUPt2HdyKyO26LwJ4IqMYoFo1+SZWbpONiWk/1mAgoAdLYK:ftO0fXcUPA9yKyO26ohU+SbNi1mAMLd
TLSH: T17938BFF3209BDD4C7A9E6F03A5BE11A96086D788A172EF50C0C8B72CC5BC97C6E14561
Submitted as: 50164840856.pdf
File type: pdf · Size: 78195 bytes
Verdict: malicious (99/100)

Detections (4 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
Emsisoft (Emergency Kit): PDF.Spam.Heur.1

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Lazarus): root_.cache_dconf_user - dynamic signal, weight 0.80, confidence 0.90
Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 36 external host(s) at runtime (7 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://bagstyle.uz/images/file/60437036447.pdf, http://www.petercar0937494634.com/upload/img/files/nutosi.pdf, https://mabuksusu.com/contents//files/26848141539.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9629 behavior events · 1 ATT&CK techniques · 4 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
desktop-hsgcbep
250.255.255.239.in-addr.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

/opt/CAPEv2/storage/analyses/30392/files/be51d82b48bbbe3a027a663211fd78676f1b3ac6bfed6999ea63ce59208be15e - be51d82b48bbbe3a027a663211fd78676f1b3ac6bfed6999ea63ce59208be15e
/opt/CAPEv2/storage/analyses/30392/files/a5e746e25f54297a712829c6c92d25922e612f18ba4911a7c68a4dff52fd894d - a5e746e25f54297a712829c6c92d25922e612f18ba4911a7c68a4dff52fd894d
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
tmp_tmp.pHX7t0Xlh9 - f8b73e824f551c8af3f7e0556ce6baf75c00c081e9c0dab749e07e4f7512c3db

Embedded URLs

https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/ngfLrbzwjls/uplcv?utm_term=king+kutter+rotary+tiller+for+sale+near+me
https://bagstyle.uz/images/file/60437036447.pdf
http://www.petercar0937494634.com/upload/img/files/nutosi.pdf
https://mabuksusu.com/contents//files/26848141539.pdf
https://songhong.info/userfiles/file/72092064071.pdf
https://zivotzaokny.eu/res/file/fopekewolebuw.pdf
https://autotrans911.com/thread/admin/uploads/file/6289953264.pdf
http://staples1981.com/clients/b/ba/ba027a536d51c1d997ee76cae6dc9017/File/70952115922.pdf
http://perseverance.cyou/updatefiles/file/vixuvepinimegaruka.pdf
https://htfcompact.com/wp-content/plugins/super-forms/uploads/php/files/7362272df50398f88688d4d7f6690b57/22455211060.pdf
http://bizwd.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ac80e7bbec1---palotoxitu.pdf
http://lighthouseofworship.com/clients/44803/File/pogorimavujotex.pdf
http://stroynerud-sm.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160aa88bc999af---73555755670.pdf
http://asokmontridental.com/userfiles/file/43229636470.pdf
https://wills.sg/wp-content/plugins/super-forms/uploads/php/files/81f5ea563cde6f05c70de5beb6ac7f0c/2155011204.pdf
http://angarakshaksecurity.com/userfiles/file/kefufomosifimoxer.pdf
https://empylean.com/wp-content/plugins/super-forms/uploads/php/files/00kn32h2gd980vbvkdfgcomdr3/vutakunafiwe.pdf
http://beautybybelief.com/admin/images/file/fomumufel.pdf
http://asesorialuishervas.com/wp-content/plugins/formcraft/file-upload/server/content/files/16082d8c067e40---87287782702.pdf
http://shuimotongyuan.com/userfiles/file/pitapi.pdf
http://www.tomasjelinek.com/img/pub/file/86780383239.pdf
http://dulichtantai.com/files/uploaded/files/33267023736.pdf
http://www.agrosystem.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/160ccfe609b591---fonenebavonalovobonamogej.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/

Embedded domains

feedproxy.google.com
www.petercar0937494634.com
mabuksusu.com
songhong.info
zivotzaokny.eu
autotrans911.com
staples1981.com
htfcompact.com
bizwd.com
lighthouseofworship.com
stroynerud-sm.ru
asokmontridental.com
wills.sg
angarakshaksecurity.com
empylean.com
beautybybelief.com
asesorialuishervas.com
shuimotongyuan.com
www.tomasjelinek.com
dulichtantai.com
www.w3.org
purl.org
ns.adobe.com
bagstyle.uz
perseverance.cyou

Embedded IP addresses

13.69.116.105
52.123.252.236
172.66.2.5
52.110.12.4
4.230.171.124
20.247.185.124
52.168.112.66
20.112.250.133
74.179.77.204
72.153.5.61
203.26.79.13
52.123.128.14
52.123.252.234
172.172.255.216
20.42.179.192
57.155.101.212
40.79.197.34
4.247.188.224
4.150.223.101

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report