MALICIOUS — jumedix.pdf

MALICIOUS — jumedix.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 8dd84b8a97ccac12b0d5bebdc9ab177170c97dbc0d51a261c9b372b1055e1f17
SHA-1: 0dbad85b1e8e1a825924049992ccc91d177df812
MD5: cdcd88f9d00eef0a4ae4a5244125e983
ssdeep: 1536:AbXP11j5P1Q1nVAZp0g3uU4kfexdYhDxdedyWWJ2sDWmpOSJAijEW:EdB+nVAZug+U4kf8dYhDxdaIN8SZ
TLSH: T1FB39CFF32197CD9CB29BAF5369A61068604ED7885171EB60408CFE7CD67C97DBE00A60
Submitted as: jumedix.pdf
File type: pdf · Size: 91388 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://www.dnevi-sekretarjev.eu/wp-content/plugins/formcraft/file-upload/server/content/files/160d30fd43ae6b---62320257813.pdf - network signal, weight 0.70, confidence 0.80
Contacted 17 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://www.dnevi-sekretarjev.eu/wp-content/plugins/formcraft/file-upload/server/content/files/160d30fd43ae6b---62320257813.pdf, http://thaicockstar.com/ckfinder/userfiles/files/gepuv.pdf, https://thingstodobahrain.net/ckfinder/userfiles/files/jebutivuvujegolapefabe.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9814 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
_dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787777219&P2=404&P3=2&P4=A6T0tnvLrYsMFb%2bDC2gQCj7qrknQStgqA51Mm74rT%2fEtULqldmDLZihWOt0H2xH3ekF1q8aeNaxahjDM5Afeow%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 700a8336edb98d9af95e3e99440afa3d1e9b602c6f92ccbaba23a660a3cb220e
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\1e78e084ba1823a1d78c58b6932b96f0.png - dfc5f1b9228262b28996d4d9164e106df00a7e316433a0ec48ad91899391b0d6
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/skout/mBVl/~3/PmAiG5ZyT-k/uplcv?utm_term=future+industry+in+2025
http://www.dnevi-sekretarjev.eu/wp-content/plugins/formcraft/file-upload/server/content/files/160d30fd43ae6b---62320257813.pdf
http://thaicockstar.com/ckfinder/userfiles/files/gepuv.pdf
https://thingstodobahrain.net/ckfinder/userfiles/files/jebutivuvujegolapefabe.pdf
http://www.pirac.org/wp-content/plugins/super-forms/uploads/php/files/8dc2e8a39eea5342f58e810fbc7d8af8/vexajube.pdf
http://mkconline.com/landmark/ckfinder/userfiles/files/jatotubu.pdf
http://itnetworkconsultingsf.com/helpdesk/app/webroot/img/userfiles/files/62759243731.pdf
https://etest.vn/app/webroot/uploads/files/givib.pdf
http://dc-a0dcf319a153.breakthroughsport.com/userfiles/files/jobekegatawawurakutizejid.pdf
https://takiminsahada.com/wp-content/plugins/super-forms/uploads/php/files/nfdpbc5es6qqap0fnn3q6jv4mh/45912860359.pdf
http://mko-yug.ru/wp-content/plugins/super-forms/uploads/php/files/84cec2f2d083b2dbdf4d0968bb3c21c7/54860999360.pdf
http://szpk.hu/_user/file/91217662246.pdf
http://www.chinahkcarplate.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ab3972ea43---53113966305.pdf
https://forcechicago.com/wp-content/plugins/super-forms/uploads/php/files/62b2fb3d5545f5ce0195614302069919/tekajorovujekawu.pdf
https://protradingindia.net/userfiles/file/348666139.pdf
https://rescue.bg/wp-content/plugins/formcraft/file-upload/server/content/files/160b782f1d64fa---54335327521.pdf
http://teknis.it/userfiles/files/walojivikimirejafomenap.pdf
http://emilymillerlaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/vafisabig.pdf
http://ahcxdq.com/uploads/file/280432219627.pdf
http://livestreaming.group/wp-content/plugins/super-forms/uploads/php/files/asavt0u0n4ficq1fpbc2t5renvt29j7k/bikogoladabatigatajena.pdf
http://maremio.ru/admin/ckfinder/userfiles/files/72260438623.pdf
http://3wsystems.com/shipinc/userfiles/files/40748985730.pdf
https://www.sesc.com.ua/wp-content/plugins/super-forms/uploads/php/files/4flbhd3im2q94r1q7ks5mlpcn3/46079077675.pdf
http://petraifevronii.ru/ckfinder/userfiles/files/winogonabugebatilib.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

feedproxy.google.com
www.dnevi-sekretarjev.eu
thaicockstar.com
thingstodobahrain.net
www.pirac.org
mkconline.com
itnetworkconsultingsf.com
dc-a0dcf319a153.breakthroughsport.com
takiminsahada.com
mko-yug.ru
www.chinahkcarplate.com
forcechicago.com
protradingindia.net
teknis.it
emilymillerlaw.com
ahcxdq.com
maremio.ru
3wsystems.com
www.sesc.com.ua
petraifevronii.ru
www.w3.org
purl.org
ns.adobe.com
etest.vn
szpk.hu

Embedded IP addresses

57.155.101.212
172.172.255.218
48.211.4.16
172.66.2.5
20.247.184.142
52.123.252.234
74.179.71.159
74.179.77.204
4.207.44.65
4.230.171.124
52.230.59.222
72.153.5.96
203.26.79.13
20.42.65.89
40.99.133.210
52.123.128.14
142.251.42.99

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report