MALICIOUS — 79680097441.pdf

MALICIOUS — 79680097441.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 50 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 90fecb07b460307759a3627172258e20b9e40ddc7337e9116110d8bf5838e1a6
SHA-1: 6c1d4704632896d0dee25eae3c84441db750e47c
MD5: a20edfefa3c0e52be3ca76ea52c63f40
ssdeep: 3072:0TpNIjm4qtv9JqulO/EsjYhaiSm+kcw57b3f:0TpN+mNv9nIzkh7bP
TLSH: T1D13BD0F32183DD0CA64A8F43A9EE11D9A44EEB841137DAA01498B73CD4BC97EBF04551
Submitted as: 79680097441.pdf
File type: pdf · Size: 103103 bytes
Verdict: malicious (99/100)

Detections (4 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Lazarus): root_.cache_dconf_user - dynamic signal, weight 0.80, confidence 0.90
Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Embedded link rated suspicious by URL analysis: http://pvsystreports.com/wp-content/plugins/super-forms/uploads/php/files/q3bap0frpt7oaqqu00ga53fet2/xazoxuvesado.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://pixomot.ru/uplcv?utm_term=paragraph+transition+words, http://phunggia.biz/userfiles/file/95069721565.pdf, https://worldkelo.com/wp-content/plugins/super-forms/uploads/php/files/04537f6c51020fc2bea5222ab6c65226/99273797464.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Contacted 7 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

1034 behavior events · 0 ATT&CK techniques · 2 dropped files.

Runtime network

ntp.ubuntu.com
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
250.255.255.239.in-addr.arpa
ff02::1:3
224.0.0.252
10.240.0.1
10.240.0.255
169.254.255.255
ff02::fb
224.0.0.251
ff02::16
185.125.190.56
ff02::2
224.0.0.22
ff02::1
185.125.190.57

Dropped files

root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
tmp_tmp.KzRS70GRR1 - decdd87a22bccb4f166edbf9e251d520668ad2beeeeb88784b0d78fa6e15246c

Embedded URLs

https://pixomot.ru/uplcv?utm_term=paragraph+transition+words
http://phunggia.biz/userfiles/file/95069721565.pdf
https://worldkelo.com/wp-content/plugins/super-forms/uploads/php/files/04537f6c51020fc2bea5222ab6c65226/99273797464.pdf
https://amkboiler.com/wp-content/plugins/super-forms/uploads/php/files/osbuhs0a10fed4m2mjo1airhjf/kerewedubigapojovo.pdf
https://fastcomputer.vn/wp-content/plugins/super-forms/uploads/php/files/2891b15441489074d9b49207e4974280/84313783178.pdf
http://www.aadhar-interior.com/userfiles/file/52020512979.pdf
https://www.dyna-tech.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1608c0f6815249---muzaloxevazawa.pdf
http://thanuyentea.com/ckfinder/userfiles/files/80706935466.pdf
http://pvsystreports.com/wp-content/plugins/super-forms/uploads/php/files/q3bap0frpt7oaqqu00ga53fet2/xazoxuvesado.pdf
http://ontheedgeofnow.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a2aae8aaf4e---21259695961.pdf
https://cafesca.org/ckfinder/userfiles/files/wufunidemanutiji.pdf
http://www.lbf-cosmetics.com/website/wp-content/plugins/formcraft/file-upload/server/content/files/160c3e86b0a5e4---45952669746.pdf
https://mimpishio1bet.com/contents//files/31023297181.pdf
https://dazzlin.co.uk/wp-content/plugins/super-forms/uploads/php/files/28ca81bd0e6286a9eb69253c86297ba7/kitavowasiji.pdf
http://joesservicecenternj.com/userfiles/files/87155822963.pdf
https://camphacement.vn/upload/files/kajogubi.pdf
http://www.greenbriarpropmgmt.com/wp-content/plugins/super-forms/uploads/php/files/ceb2eef575a806b2b413d2e29f43dea1/rikix.pdf
https://forcechicago.com/wp-content/plugins/super-forms/uploads/php/files/e69743adc8919d4ac25f9d0896f2cb12/5991156031.pdf
http://alkanboya.com/files/file///63237846539.pdf
http://www.majoriscambio.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160aa8a8242390---xudefas.pdf
https://www.rogierstoel.nl/wp-content/plugins/super-forms/uploads/php/files/ke0j9101cti9c6u82v7ihpql3u/35063429709.pdf
http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1610ee44110a96---nerelajiwepogul.pdf
https://somogyplusz.hu/files/61185991609.pdf
http://www.alfainstal.pl/wp-content/plugins/formcraft/file-upload/server/content/files/1608f5c1bd7f28---78619467740.pdf
https://mps-india.com/userfiles/files/muroki.pdf

Embedded domains

pixomot.ru
phunggia.biz
worldkelo.com
amkboiler.com
www.aadhar-interior.com
www.dyna-tech.nl
thanuyentea.com
pvsystreports.com
ontheedgeofnow.com
cafesca.org
www.lbf-cosmetics.com
mimpishio1bet.com
dazzlin.co.uk
joesservicecenternj.com
www.greenbriarpropmgmt.com
forcechicago.com
alkanboya.com
www.majoriscambio.com.br
www.rogierstoel.nl
www.1000ena.com
www.alfainstal.pl
mps-india.com
tucsonhomewindowtint.com
fw-simple.com
markmont.eu

Embedded IP addresses

74.179.77.204
72.145.35.111
40.84.85.40

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report