MALICIOUS — 8dfc027aba6a81007bdf21888b5f128dd0fc41318969a98a1d0928ccae3265c4

MALICIOUS — 8dfc027aba6a81007bdf21888b5f128dd0fc41318969a98a1d0928ccae3265c4 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 8dfc027aba6a81007bdf21888b5f128dd0fc41318969a98a1d0928ccae3265c4
SHA-1: e652671c6c658cbd4b4eae312f436334aa80d0b7
MD5: eae0a7bf31dd08967194d2d915f2d587
ssdeep: 1536:a1XucsDxhBLbr4r73sKi33ab1DkZZAfimo3qrr5TsyLNw1PrgNzllTNA9yfPX8lz:YuJRvrKLsHeFKCfO6rr5rgIz3pJXI
TLSH: T10D38D1F352A7DD0CB58797837EB7342EB489C7DC6522AB901095672C81BC26E7F10A21
Submitted as: 8dfc027aba6a81007bdf21888b5f128dd0fc41318969a98a1d0928ccae3265c4
File type: pdf · Size: 79424 bytes
Verdict: malicious (98/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!EAE0A7BF31DD
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4383797/normal_5ffeb75995bf5.pdf - network signal, weight 0.70, confidence 0.80
Contacted 19 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://ponafet.ru/strik?utm_term=ge+universal+remote+control+codes+for+sharp+tv, https://cdn.sqhk.co/suwuwewazaka/dih8egj/656679418.pdf, https://cdn-cms.f-static.net/uploads/4422890/normal_606c9eb5ef698.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9855 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\46b1af0ae67a36cb364f4123a3113cd4.png - 6f6014997a3b4dfc354388e96367c8f1bd6b5664cd47c4a9e59e6a2f4893d692
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 55ef32403dba1461e932b52445b3f8375bcf8501a5df1efcf25b3dc732645941
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://ponafet.ru/strik?utm_term=ge+universal+remote+control+codes+for+sharp+tv
https://cdn.sqhk.co/suwuwewazaka/dih8egj/656679418.pdf
https://cdn-cms.f-static.net/uploads/4422890/normal_606c9eb5ef698.pdf
http://xovefepotulat.epizy.com/animals_worksheet_esl.pdf
https://static.s123-cdn-static.com/uploads/4383797/normal_5ffeb75995bf5.pdf
https://uploads.strikinglycdn.com/files/dee9052b-bdfb-4999-9306-759226df9cf0/audre_lorde_quotes_on_identity.pdf
https://static.s123-cdn-static.com/uploads/4423732/normal_5ff9d6eda8e0a.pdf
http://teguruta.medianewsonline.com/50161306833.pdf
https://cdn.sqhk.co/papusabefo/iidVFnD/concentric_diversification_definition_economics.pdf
https://uploads.strikinglycdn.com/files/4a857d4f-9ef3-48df-8694-cd01a4a22d0d/wagitakubige.pdf
http://pojozija.onlinewebshop.net/voxagonubaligopizopowamij.pdf
https://uploads.strikinglycdn.com/files/3fbe9806-92d8-4df1-a396-371363af6d1c/how_do_i_use_my_mazda_remote_starter.pdf
http://iglivesupportteam.com/37490265606la9wg.pdf
https://uploads.strikinglycdn.com/files/621c4ae1-bf40-4b6b-9b86-69ad1b6b1172/what_was_the_us_like_before_the_constitution.pdf
https://static.s123-cdn-static.com/uploads/4466391/normal_600574be8b7c7.pdf
https://uploads.strikinglycdn.com/files/58c07fa3-d54c-47db-8df4-9287f618bcce/how_to_assemble_ingenuity_smartbounce_automatic_bouncer.pdf
http://tapasin.sportsontheweb.net/85239235415.pdf
http://top-salez.site/31634750525z54im.pdf
http://lujotuxubegu.rf.gd/best_algorithmic_trading_books_python.pdf
http://tefitagesev.mypressonline.com/relation_and_function_definition_in_hindi.pdf
http://zobuwijezad.onlinewebshop.net/how_long_do_you_cook_frozen_turkey_burgers_on_a_george_foreman_grill.pdf
https://cdn.sqhk.co/soribivevi/oWnq7b2/91229748584.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/

Embedded domains

ponafet.ru
cdn.sqhk.co
cdn-cms.f-static.net
xovefepotulat.epizy.com
static.s123-cdn-static.com
uploads.strikinglycdn.com
teguruta.medianewsonline.com
pojozija.onlinewebshop.net
iglivesupportteam.com
tapasin.sportsontheweb.net
top-salez.site
tefitagesev.mypressonline.com
zobuwijezad.onlinewebshop.net
www.w3.org
purl.org
ns.adobe.com
lujotuxubegu.rf.gd

Embedded IP addresses

172.66.2.5
52.123.252.218
4.144.132.223
52.110.12.18
4.230.171.124
74.178.76.128
51.104.15.252
20.112.250.133
52.123.129.14
40.99.133.210
40.99.133.226
4.207.44.72
74.178.76.44
203.26.79.13
52.123.252.229
20.42.65.91
20.184.175.13
20.184.175.7
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report