MALICIOUS — 919cc41afe7f06c27558537fefd27c5d0ae460122ddb1b290f3baffff5314785

MALICIOUS — 919cc41afe7f06c27558537fefd27c5d0ae460122ddb1b290f3baffff5314785 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 919cc41afe7f06c27558537fefd27c5d0ae460122ddb1b290f3baffff5314785
SHA-1: e7d872e9f4eb5175c97fc2c6865fbbb4e48b2af7
MD5: f1e6b5b69ca497c9a657299da9752568
ssdeep: 1536:fwMWB34wtbqwLxPg4ZZEhp/evFnUk9mWOpOwrwHlujdWGKFy/x:XW99Llg4LEhBetnJ9bwrwHo4FO
TLSH: T1C037BFF3218BDD9C7A579B432CBB10AAA449D78C2171DF905088776CC5BC9BDBE10A50
Submitted as: 919cc41afe7f06c27558537fefd27c5d0ae460122ddb1b290f3baffff5314785
File type: pdf · Size: 72809 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://sdes.in/uploads/40663114334.pdf - network signal, weight 0.70, confidence 0.80
Contacted 17 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://ambulatorioveterinariobubiniregini.eu/userfiles/files/45280266629.pdf, http://kaitosushisb.com/uploads/files/famusokikifagegevaba.pdf, http://fine-cottage.ru/userfiles/files/2499675511.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9601 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - c99635473f1bc43733ec9f380b66d49307f43dae668f3fda5ac0b1da177c342c
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\94e926eb6487af9a0fd0401ed61d139e.png - ea2c78050828c23c2baf05d68dd791231c34147c75c26543b7bba28856892b84
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/skout/mBVl/~3/DOqCt-cVA4I/uplcv?utm_term=sims+3+java+apk
http://ambulatorioveterinariobubiniregini.eu/userfiles/files/45280266629.pdf
http://kaitosushisb.com/uploads/files/famusokikifagegevaba.pdf
http://fine-cottage.ru/userfiles/files/2499675511.pdf
http://sdes.in/uploads/40663114334.pdf
http://www.lukoilmarine.com/ckfinder/userfiles/files/62575425937.pdf
http://dlshixiang.com.cn/ckfinder/userfiles/files/zapejafagivalegotabugos.pdf
https://karolinanowak.com/userfiles/file/netirazokinuwo.pdf
http://classtool.info/upload/files/fogabalubozenanumeda.pdf
http://www.darvidproperty.com/news/file/39424479750.pdf
https://www.c2commercial.com/wp-content/plugins/super-forms/uploads/php/files/3aa0d68a3d3353259f59fc25e4252fb3/39429194678.pdf
http://itcck.org/upload/editor/file/76829394753.pdf
http://sunil.kr/uploadfile/fckeditor/file/62403584316.pdf
https://www.dekleinewerf.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16140a3746ed78---68431072697.pdf
https://euronuts2009.ge/files/files/90959576400.pdf
http://0985028898.kad.tw/kads/ckfinder/userfiles/files/60020415433.pdf
http://gerastar.com/userfiles/file/nokalekiwuj.pdf
https://frigosztufi.ro/ckfinder/userfiles/files/25892152840.pdf
http://khonggianxua.samdigroup.vn/app/webroot/upload/files/97681843264.pdf
https://totspotdaynursery.co.uk/ckfinder/userfiles/files/xumogimagizebinevupaxi.pdf
http://livestreaming.group/wp-content/plugins/super-forms/uploads/php/files/is0amtfgf8h4tscc4qagc6krhhusqp77/fonizosisolal.pdf
https://kapefashion.com/files/files/bazavedezujugumomudono.pdf
https://dolmalatrek.com/userfiles/file/97305386329.pdf
https://ikuseikyokai.jp/ckmedia/files/kugelovatevu.pdf
https://ctapigroup3.com/contents/files/53468462245.pdf

Embedded domains

feedproxy.google.com
ambulatorioveterinariobubiniregini.eu
kaitosushisb.com
fine-cottage.ru
sdes.in
www.lukoilmarine.com
dlshixiang.com.cn
karolinanowak.com
classtool.info
www.darvidproperty.com
www.c2commercial.com
itcck.org
sunil.kr
www.dekleinewerf.nl
0985028898.kad.tw
gerastar.com
totspotdaynursery.co.uk
kapefashion.com
dolmalatrek.com
ikuseikyokai.jp
ctapigroup3.com
www.caissedesecolesdu5eme.fr
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

74.178.232.29
20.42.65.94
20.42.65.88
178.214.223.10
4.150.223.112
52.123.252.193
4.144.132.223
20.42.179.192
4.230.171.124
4.150.223.104
135.233.95.144
40.103.64.226
52.123.129.14
74.179.71.159
203.26.79.13
57.155.101.212
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report