MALICIOUS — calories_in_fruits_and_vegetables_chart_printable.pdf

MALICIOUS — calories_in_fruits_and_vegetables_chart_printable.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 8f4f904fc5637054c2c31f232803edc4ab792ded73c119ef989e16916004d6dd
SHA-1: 4150a51dbb1d0bb5acc348d34c10b4d8b14e9fc4
MD5: 559e43b90ab5dd6344635640f5ad2194
ssdeep: 1536:l69tG1SQ9AI0so7KsJYYOKtQqRgqIMvswk34n595+ETxjcpyHWivUeQlLg:EgSij0s4KsqKtRgqIMUwkIn54yb8y
TLSH: T10538D0F36297DC8C7A9A5F036DB7352C648ED7881522766011CC6A2C85BCBBD3E50E60
Submitted as: calories_in_fruits_and_vegetables_chart_printable.pdf
File type: pdf · Size: 80261 bytes
Verdict: malicious (96/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!559E43B90AB5
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 21 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://4f65703b-d4c0-4c9c-9e30-73c8cc83ec5d.filesusr.com/ugd/54fa57_a2fe98c56e3449788f1c94996b7665b8.pdf?index=true - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://botokaw.ru/strik?utm_term=calories+in+fruits+and+vegetables+chart+printable, http://reduslimitalia-oficial.site/90398831016wmr2k.pdf, https://cdn.sqhk.co/juzivadareka/jg1Sibw/real_steel_mobile_game_download.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (10 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9657 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
desktop-hsgcbep
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\7f762d12dcd84204feb0bcc279cad6c7.png - 9d4bfbff7577ad495a4826b742e21cde9b5875651dfb5187f429e8a5af2e67d4
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 38966c224b1df6f081819fa554cc046a55b86b02923756915f9edbd03a32e340
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://botokaw.ru/strik?utm_term=calories+in+fruits+and+vegetables+chart+printable
http://reduslimitalia-oficial.site/90398831016wmr2k.pdf
https://cdn.sqhk.co/juzivadareka/jg1Sibw/real_steel_mobile_game_download.pdf
https://s3.amazonaws.com/dibedamoka/78411431393.pdf
http://lumulexidavotaj.epizy.com/setbackgroundcolor_android_hex.pdf
http://kivazitegolaluz.rf.gd/c_interview_objective_questions_and_answers.pdf
https://lolovegadagofi.weebly.com/uploads/1/3/1/6/131636941/zutajizij.pdf
https://petavigavixate.weebly.com/uploads/1/3/4/4/134459614/3495966.pdf
https://4f65703b-d4c0-4c9c-9e30-73c8cc83ec5d.filesusr.com/ugd/54fa57_a2fe98c56e3449788f1c94996b7665b8.pdf?index=true
https://0ecef3a8-5193-4df1-8dcb-1b7dd0f2be2a.filesusr.com/ugd/e6092c_6c4e4c0725164ece83dd814055249c88.pdf?index=true
https://jesisime.weebly.com/uploads/1/3/4/8/134886507/wapubesowuve.pdf
https://s3.amazonaws.com/gudukupir/basoviroro.pdf
https://s3.amazonaws.com/bededuxotulapil/39721453888.pdf
https://pimupaxepa.weebly.com/uploads/1/3/1/8/131857198/misavoxazefifubuzub.pdf
http://avtoshkola-region26.ru/swann_security_camera_4k_ultra_hdipi0f.pdf
https://gopogaxewose.weebly.com/uploads/1/3/4/0/134013169/6dab5d0d.pdf
http://bioforce-co.site/microsoft_office_word_2020_calendar_templater7ok3.pdf
https://s3.amazonaws.com/resabomibogodaw/53303746854.pdf
https://cdn.sqhk.co/zukuxenopo/Mjcijhc/58707887504.pdf
https://s3.amazonaws.com/miwolezedubujoz/backup_android_rom_to_sd_card.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/

Embedded domains

botokaw.ru
reduslimitalia-oficial.site
cdn.sqhk.co
s3.amazonaws.com
lumulexidavotaj.epizy.com
lolovegadagofi.weebly.com
petavigavixate.weebly.com
4f65703b-d4c0-4c9c-9e30-73c8cc83ec5d.filesusr.com
0ecef3a8-5193-4df1-8dcb-1b7dd0f2be2a.filesusr.com
jesisime.weebly.com
pimupaxepa.weebly.com
avtoshkola-region26.ru
gopogaxewose.weebly.com
bioforce-co.site
www.w3.org
purl.org
ns.adobe.com
kivazitegolaluz.rf.gd

Embedded IP addresses

20.42.179.204
52.168.117.170
172.172.255.216
172.215.188.232
172.215.188.225
135.232.92.34
4.230.171.124
57.154.63.210
72.154.7.97
203.26.79.13
4.155.94.229
51.105.71.137
135.233.95.144
20.76.201.171
52.123.128.14
40.103.64.242
4.207.44.65
142.250.207.3
92.223.78.30
48.199.12.1
20.184.175.18

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report