MALICIOUS — 6132091015.pdf

MALICIOUS — 6132091015.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 8e58b5333808094b36a43a86c259a402d2113103057193d6800ff40462e78e80
SHA-1: 88b6d9236e3a13aace32675e82f9a1869a723f84
MD5: 4f0e2942a29a43ba90417cf20785849d
ssdeep: 3072:i4nMdifrFIR8FFHwpSM3D/hthC7RcDit5:i4nMdorFDFbI/LDm
TLSH: T1CF3BD1F3207BCE8C7597DB47A9E61159B09ADEC83152EA905584BA3C887C5FC7F00A21
Submitted as: 6132091015.pdf
File type: pdf · Size: 108807 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://songhongresort.com/img/files/poxovema.pdf - network signal, weight 0.70, confidence 0.80
Contacted 19 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://www.focus.mu/wp-content/plugins/super-forms/uploads/php/files/76a42afa63000fe0738baf5e9599e8e1/43599928873.pdf, https://gmt-tw.com/app/webroot/userfiles/files/95567421678.pdf, https://songhongresort.com/img/files/poxovema.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9733 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 0521b5ca76bf5ce23fee21f74f1fcba8fdafb08b6d6f461be993727630f0a781
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\43998c1855a361e52555772c62664496.png - 6b51fe6739a4659e0dbff410003134afa33e627db39a36612e407da3c9e9fbd1
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/cv9VXjIrmdE/uplcv?utm_term=trinh+duyet+web+nhanh+nhat+cho+android
https://www.focus.mu/wp-content/plugins/super-forms/uploads/php/files/76a42afa63000fe0738baf5e9599e8e1/43599928873.pdf
https://gmt-tw.com/app/webroot/userfiles/files/95567421678.pdf
https://songhongresort.com/img/files/poxovema.pdf
http://trust-law-firm.com/userfiles/file/20210908212128_1521007211.pdf
http://9jamail.com/FCKeditor/editor/filemanager/connectors/userfiles/file/56866777413.pdf
http://kursverwaltung.fit-n-essen.ch/ckfinder/userfiles/files/81829134341.pdf
http://kite-surf.sk/files/94815182945.pdf
https://ylwlgwadmin.ylwl.cn/upload/files/fipukujod.pdf
https://alummaswaja.com/yii/sdbalikpapan/home/images/upload/files/63258709696.pdf
http://lapawan15.com/shop/fck_file/file/buxeji.pdf
http://elitaliaweb.it/upload/file/bisodedinigemupigobibikus.pdf
https://equator-maritime.com/userfiles/file/wafojateze.pdf
https://pensiunea-escape.ro/ckfinder/userfiles/files/90679261896.pdf
http://mobitransjogja.com/files/dawakutikexigizor.pdf
https://hijaustabilo.com/contents/files/kugazopekasobodom.pdf
http://www.ettermanenterprises.com/ckfinder/userfiles/files/nenadowamebuvudimujudaf.pdf
https://weekendtripskolkata.com/userfiles/file/ruruwijaxumavunig.pdf
http://paulabenveniste.com/UserFiles/file/kuxaluvowusiguzupaza.pdf
https://dursunguney.com/userfiles/files/sobosimoxudes.pdf
http://www.mkkdigital.pt/wp-content/plugins/formcraft/file-upload/server/content/files/16139931a678ea---xewuzidibatige.pdf
http://www.gyndoktors.de/ckfinder/userfiles/files/58393053801.pdf
https://greenturtleproductions.com.au/wp-content/plugins/super-forms/uploads/php/files/b79cb7273744ea5e5ac0b979b4bc3ebf/79383620103.pdf
http://santehnika34.ru/images/file/dilelazagod.pdf
https://mytutr.com/wp-content/plugins/super-forms/uploads/php/files/51a539e4a0194b3e489b8633bacda7a3/72323797643.pdf

Embedded domains

feedproxy.google.com
gmt-tw.com
songhongresort.com
trust-law-firm.com
9jamail.com
kursverwaltung.fit-n-essen.ch
ylwlgwadmin.ylwl.cn
alummaswaja.com
lapawan15.com
elitaliaweb.it
equator-maritime.com
mobitransjogja.com
hijaustabilo.com
www.ettermanenterprises.com
weekendtripskolkata.com
paulabenveniste.com
dursunguney.com
www.gyndoktors.de
greenturtleproductions.com.au
santehnika34.ru
mytutr.com
www.w3.org
purl.org
ns.adobe.com
www.focus.mu

Embedded IP addresses

4.150.223.107
48.211.4.16
57.155.104.224
52.110.12.4
4.230.171.124
52.230.60.54
20.165.94.54
40.103.64.226
74.178.240.61
40.99.134.18
72.153.5.137
203.26.79.13
135.233.45.221
52.123.252.242
52.123.252.232
92.223.78.30
135.234.160.245
52.182.141.63
40.79.141.155

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report