MALICIOUS — 59529365118.pdf

MALICIOUS — 59529365118.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 951c3aac061ca14d56b4290f5a7901ceb18cac135ce66db5985eab59bcfeeab3
SHA-1: 5a18753c6981a2c453f1af45ba3a8b9325fd34aa
MD5: 0b6d99865adf363a20392cd8984dedfa
ssdeep: 1536:PNVtRGDCzo7MW7DnNRPXHjtv90KMWkNpOPaWe5r/KWhhK:VVtRGDHrnnPXDtv97BPU5r/KWu
TLSH: T16037C0F3229FCC5C779A8F0369EB129C9189D78D7121EA80818CB63C95BC57DBE10961
Submitted as: 59529365118.pdf
File type: pdf · Size: 74708 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://adrfarysz.pl/userfiles/file/suvigafa.pdf - network signal, weight 0.70, confidence 0.80
Contacted 20 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://poexali.org/static/image/_u/system/files/7204236797.pdf, http://jinruily.com/UploadFile/file/20210924135655420.pdf, https://amd-export.com/site/upload/file/deguwikisoborati.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9683 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
ntp.ubuntu.com
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787777915&P2=404&P3=2&P4=ImkBMME%2fPBKn0EN2u3UkfrvKUsVMC6RbmlnTvRIddInDxX0S4UKxyymtulpPhT%2f3dyCnxNyEDP1NXJW%2bAlocvw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787777965&P2=404&P3=2&P4=EpUz3ns2Dx%2blpj%2bE8k4CpjT98obnG22aXvfACao1%2bZIGWgtHVbH%2fHWL0TdfUAOfLu%2bfYJMbZqSI0K4MGf6sN6g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\cf35889bdea57de5d61ea530fca2a9d1.png - f1e525079dea5f800959746197eb3217a1a7bd42be42482b9dc829376cc64539
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 1adec1102bc20b99bbf7cc7548830e9620988d09afe01efadfa46c1846804b35
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/zMnd8XtcwSM/uplcv?utm_term=wallet+passes+for+android
http://poexali.org/static/image/_u/system/files/7204236797.pdf
http://jinruily.com/UploadFile/file/20210924135655420.pdf
http://qtjdb.com/UploadFile/2021/09/12/file/20210912_035719_116.pdf
https://amd-export.com/site/upload/file/deguwikisoborati.pdf
https://adrfarysz.pl/userfiles/file/suvigafa.pdf
http://www.colegiometa.net/home/wp-content/plugins/formcraft/file-upload/server/content/files/1614b3eaa5e4e2---xurowoxazesixirikux.pdf
http://tvcsoltau.de/userfiles/file/gonalabamarupatumosila.pdf
https://mobilaide.com/upload/editor/file/gikadov.pdf
http://mrcookie.tw/upload/editor/file/28090046261.pdf
https://advicezone.org.uk/wp-content/plugins/super-forms/uploads/php/files/iogifl2q58gi7dse3pqsn1o8sq/7009757756.pdf
http://cuacuongiare.vn/upload/files/zipekazojegipog.pdf
https://www.prieur-equipement.com/ckfinder/userfiles/files/23320791780.pdf
http://hoangminhsaigon.vn/@dmin/js/ckfinder/userfiles/files/xulimipaxasajeb.pdf
https://extractos.assaludips.com/Proyectos_PHP/gestor/images/file/bajujumuj.pdf
http://drinkandshrink.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1613067e8c5e2a---47931074584.pdf
http://fruitsad.pl/images/file/70383176305.pdf
http://uni-farm.pl/ckfinder/userfiles/files/kovoxigogom.pdf
https://mai-avto.ru/upload_files/file/wimuvopugunesarepo.pdf
https://markzone.az/wp-content/plugins/super-forms/uploads/php/files/vj32pr9qmhopldkkau07ja83em/kiniwibepasezotafap.pdf
http://wenxuezj.com/images/File/xuworo.pdf
http://nnk.gr/wp-content/plugins/formcraft/file-upload/server/content/files/1614388d3c1132---1899231165.pdf
https://ivanamihic.com/files/22465352741.pdf
http://sarljarry.com/userfiles/file/parudi.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

feedproxy.google.com
poexali.org
jinruily.com
qtjdb.com
amd-export.com
adrfarysz.pl
www.colegiometa.net
tvcsoltau.de
mobilaide.com
mrcookie.tw
advicezone.org.uk
www.prieur-equipement.com
extractos.assaludips.com
drinkandshrink.co.uk
fruitsad.pl
uni-farm.pl
mai-avto.ru
wenxuezj.com
ivanamihic.com
sarljarry.com
www.w3.org
purl.org
ns.adobe.com
cuacuongiare.vn
hoangminhsaigon.vn

Embedded IP addresses

52.230.59.222
52.123.252.202
162.159.142.9
74.179.71.159
52.110.12.8
4.230.171.124
72.145.35.104
203.26.79.13
74.179.77.204
74.178.240.51
52.123.129.14
40.79.167.9
52.123.128.14
52.123.252.192
92.223.78.30
20.184.175.17
135.233.45.223
4.209.250.170
4.150.223.103
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report