MALICIOUS — 8eb1b633c5875588c5c770bbfed2ef4fcf731bf952466bf2702a24b68d69f85b

MALICIOUS — 8eb1b633c5875588c5c770bbfed2ef4fcf731bf952466bf2702a24b68d69f85b is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 8eb1b633c5875588c5c770bbfed2ef4fcf731bf952466bf2702a24b68d69f85b
SHA-1: 60b206dbc4d1fa96a01a007e42debbe6960c4469
MD5: 83350e9a2863f7ccb9fffafe6acd6f47
ssdeep: 1536:AaDl1i6mXKtkRTX+LwlMAiYbGVNfGWQAXq2qjPKOkLWPuWUpO774Jy:TDl3m5Tu8WAvGVNTFAV0WPZ7p
TLSH: T1CC37CFF360A7ED9CBB9B9F0325A60159748BD3896172FB8090487A7CD1BC57DAF10610
Submitted as: 8eb1b633c5875588c5c770bbfed2ef4fcf731bf952466bf2702a24b68d69f85b
File type: pdf · Size: 70823 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 19 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://mazdooradda.com/userfiles/file/gewifobubesatipi.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: http://sysquare.com/UserFiles/files/51615049272.pdf, https://bem-sa.com/img/file/mozujaxofizatasevel.pdf, http://mazdooradda.com/userfiles/file/gewifobubesatipi.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9676 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
ntp.ubuntu.com
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
_dosvc._tcp.local
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - da5b26df33db4fa77efea515f1dd1c3049676ab46d3499c5066abbdc6c1ba83b
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\2cc147369804f52d89f839877c6b7718.png - 19e54bdfbe8b5496a83ff678ce55475f43324252b64c6bc95f4a9a0d5b38509f
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/FevRqgeaUVY/uplcv?utm_term=tfs+android+18
http://sysquare.com/UserFiles/files/51615049272.pdf
https://bem-sa.com/img/file/mozujaxofizatasevel.pdf
http://mazdooradda.com/userfiles/file/gewifobubesatipi.pdf
https://mygenius.ru/admin/ckfinder/userfiles/files/26667264833.pdf
https://www.budgetskemaet.dk/wp-content/plugins/formcraft/file-upload/server/content/files/16145e5687879f---jiwitojegipiwajewibak.pdf
https://nevisnews.com/userfiles/powuditolovoruvug.pdf
https://adproissy.emailingmanager.com/uploads/editor/file/pinetenap.pdf
https://euroialinsol.ro/userfiles/file/32209608551.pdf
http://kimwendelldesign.com/ckfinder/userfiles/files/baritilazaxezuguwave.pdf
http://zenithmetals.com/files/xopugafewazexitomi.pdf
https://cosplay-expo.it/ckfinder/userfiles/files/24877919162.pdf
http://tulga.ru/editor/files/71524702584.pdf
http://vstarmp.cn/upload/files/20210905_123338.pdf
https://www.bluegreenshouseboats.in/wp-content/plugins/formcraft/file-upload/server/content/files/1614e1d19c2306---rabisawusefixubejojepip.pdf
http://autoneza.cz/UserFiles/File/xepemafusegazofiwomedu.pdf
http://johnlillylaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/89887627182.pdf
http://ibrahimabuomira.com/ckeditor/ckfinder/userfiles/files/32203164030.pdf
http://waycreon.net/bhaskar/yii/upload/files/xetulopi.pdf
http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/161409534152e4---zonexapiten.pdf
https://atx-stroy.ru/wp-content/plugins/super-forms/uploads/php/files/431c8e54ba4478ac14556d06fee6d163/xanaruzavofulukuje.pdf
http://gustosandvic.com/ckfinder/userfiles/files/80498243034.pdf
http://cheers-gifts.com/userfiles/34064347717.pdf
https://elmawadah.com/userfiles/file/52078452958.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

feedproxy.google.com
sysquare.com
bem-sa.com
mazdooradda.com
mygenius.ru
nevisnews.com
adproissy.emailingmanager.com
kimwendelldesign.com
zenithmetals.com
cosplay-expo.it
tulga.ru
vstarmp.cn
www.bluegreenshouseboats.in
johnlillylaw.com
ibrahimabuomira.com
waycreon.net
hellnocancershow.com
atx-stroy.ru
gustosandvic.com
cheers-gifts.com
elmawadah.com
www.w3.org
purl.org
ns.adobe.com
www.budgetskemaet.dk

Embedded IP addresses

40.79.150.121
135.232.92.137
52.123.252.224
20.247.184.197
52.110.12.10
72.145.35.106
4.230.171.124
203.26.79.13
135.233.95.144
20.42.73.27
20.231.239.246
52.123.129.14
40.99.133.210
40.99.134.2
20.42.73.30
92.223.78.30
48.192.143.121
4.150.223.96
20.184.175.3

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report