MALICIOUS — 20720298370.pdf

MALICIOUS — 20720298370.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 953e2027fe6a0628c51aa7675928273eae57dda9d3ec92f070df862ecb65e96a
SHA-1: 9f952527b3ae9b476227a899e10def53b06013a6
MD5: 65a4b81120f5636c6ce1f237d496f3e3
ssdeep: 1536:VVS6xgzkxLWln/YKiroDj3KWTWuPmuoITyCWSvnBYTWllBYfNuWXpO/dzvXbrU:TSSxLenAHcHtTWrIk+BY8/0u/dzU
TLSH: T16C39C0F36297ED9C32DBDB0766EA0299648AE7C82172DB50105CB77C91BC6BC3E10941
Submitted as: 20720298370.pdf
File type: pdf · Size: 87854 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 23 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://bjhtdszdh.com/v15/Upload/file/202176324142045.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: http://streetnn.ru/data/upload/ck/files/87332257261.pdf, https://www.dolphinrfid.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a26d7a4cde8---94394406937.pdf, https://www.verpoort-bouw.be/wp-content/plugins/formcraft/file-upload/server/content/files/160f6d97318636---vaburogarinisavedulu.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9682 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
_dosvc._tcp.local
desktop-hsgcbep
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
desktop-hsgcbep._dosvc._tcp.local

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\faa0faba2ba314c748e3f21bda10da7c.png - 0f4b023f826257cbf46e11f14c88d78c7b952281ec81c14cbca15e69fa0603e0
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 456035f1d27498ca9e8e6d477b3b941f0868d0b341f9191cf2cb3091fd8ef3d4
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/3CAf4wW3hvY/uplcv?utm_term=wwe+12+psp+iso
http://streetnn.ru/data/upload/ck/files/87332257261.pdf
https://www.dolphinrfid.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a26d7a4cde8---94394406937.pdf
https://www.verpoort-bouw.be/wp-content/plugins/formcraft/file-upload/server/content/files/160f6d97318636---vaburogarinisavedulu.pdf
https://www.grandiosa.is/wp-content/plugins/super-forms/uploads/php/files/fvgfkaf8asonud3ln7bldn4176/80352423862.pdf
https://sdyh.gr/wp-content/plugins/super-forms/uploads/php/files/5d8h6khsisrltaogh87c5mnoo2/8171628262.pdf
http://dragoniresorts.com/userfiles/41813802575.pdf
https://adbetelparaguay.com/wp-content/plugins/super-forms/uploads/php/files/c01673284af00ef999494b9001da9182/kupebomebulesuziwome.pdf
http://mmbc.cz/_data/user_files/file/49716642509.pdf
http://bjhtdszdh.com/v15/Upload/file/202176324142045.pdf
https://paperland.bg/uploads/file/84820325599.pdf
http://hanarotalk.com/userfiles/file///palunivasutenup.pdf
http://asesorialuishervas.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ff51bde737---fobezejoben.pdf
http://momsystem.ru/public/file/bizaguzevuraj.pdf
https://decoveinvestment.com/userfiles/file/kifik.pdf
https://hyundaia.ru/userfiles/file/30293271295.pdf
https://mariapolis.net/ckfinder/userfiles/files/majeno.pdf
http://www.guaitoli.eng.br/wp-content/plugins/formcraft/file-upload/server/content/files/1608da88339c82---78764983518.pdf
http://www.lifestaralberta.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b3a8f278a9f---18801147290.pdf
http://xinyuemu.net/assets/202106/files/20210630150324301490.pdf
https://expobar.vn/app/webroot/files/images/pages/files/14795584571.pdf
https://www.medicalbi.com/ckfinder/userfiles/files/zazafirora.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/

Embedded domains

feedproxy.google.com
streetnn.ru
www.dolphinrfid.com
www.verpoort-bouw.be
dragoniresorts.com
adbetelparaguay.com
bjhtdszdh.com
hanarotalk.com
asesorialuishervas.com
momsystem.ru
decoveinvestment.com
hyundaia.ru
mariapolis.net
www.guaitoli.eng.br
www.lifestaralberta.com
xinyuemu.net
www.medicalbi.com
www.w3.org
purl.org
ns.adobe.com
www.grandiosa.is
sdyh.gr
mmbc.cz
paperland.bg
expobar.vn

Embedded IP addresses

203.26.79.13
4.207.44.71
172.172.255.217
20.184.175.19
20.42.179.204
74.179.77.204
20.165.94.46
172.215.188.225
52.110.12.10
72.154.7.107
4.230.171.124
4.144.132.223
74.178.76.54
20.236.44.162
20.165.94.63
52.123.128.14
74.178.240.61
172.178.240.163
142.250.183.35
20.184.175.13
4.150.223.100
48.200.63.27
142.251.42.99

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report