MALICIOUS — 954aabfc9ac046c1864e42ec15461acef9bfc2ecfc231a057cd9c4197c6e1cd1

MALICIOUS — 954aabfc9ac046c1864e42ec15461acef9bfc2ecfc231a057cd9c4197c6e1cd1 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 954aabfc9ac046c1864e42ec15461acef9bfc2ecfc231a057cd9c4197c6e1cd1
SHA-1: 37ebed29e8091d084b9f8b49888205cb4a000a43
MD5: c9bdd394f456ffe83859599a4e76648d
ssdeep: 1536:1VwGIgJkIjHhcF93dmqmk7cJNQbDj14N4fWapOtQHWRNCuN7w6d/V:l/JXBcf8JkIKj1e4wtQIlP
TLSH: T12A37D0E320D7DE5C7A8ADB43ABFB21AC948ED3496261DA6090883A7CD17C97D7F00511
Submitted as: 954aabfc9ac046c1864e42ec15461acef9bfc2ecfc231a057cd9c4197c6e1cd1
File type: pdf · Size: 70305 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://www.ap-arte.ro/fckupload/file/jusuposulemenexukexabofen.pdf - network signal, weight 0.70, confidence 0.80
Contacted 19 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://www.ap-arte.ro/fckupload/file/jusuposulemenexukexabofen.pdf, http://noahmission.org/dataroom/file/jevitu.pdf, https://togeltop.net/contents/files/wiwutofimisomiriduzuso.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9794 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
desktop-hsgcbep
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\787c66b16531c6e8c29a04eaa985e7a7.png - dfd535e13037a92ab6f7d0f01d8dea0a64e4b7aaaa3f3e38ae1114c2d68a657f
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - a7ba42bcd8d06792d3795b4391b87c6cb2ab6f1ce0cb80e3fee88318eedc1727
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/S30rS-6n6vg/uplcv?utm_term=tampermonkey+scripts+krunker
http://www.ap-arte.ro/fckupload/file/jusuposulemenexukexabofen.pdf
http://noahmission.org/dataroom/file/jevitu.pdf
https://togeltop.net/contents/files/wiwutofimisomiriduzuso.pdf
https://serihosting.com/calisma2/files/uploads/votab.pdf
https://lotte-ppta.com/beta/assets/file/noramo.pdf
https://endobible.com/userfiles/file/satekozow.pdf
https://www.greenlakecruises.com/ckfinder/userfiles/files/83872242088.pdf
http://leeharringtonhomes.com/userfiles/file/4820170894.pdf
https://glycocalyx.nl/userfiles/image/file/44113519811.pdf
https://estatecambodia.com/htdocs/cljr/data/files/buxazopadogunati.pdf
http://originalavto.ru/userfiles/file/rivolosedijodujabikirujo.pdf
http://www.tahi.hu/ckfinder/userfiles/files/21883761427.pdf
https://weishinclinic.com/uploads/files/202109120102446380.pdf
https://leicht-spb.ru/wp-content/plugins/super-forms/uploads/php/files/14eb866f8a335acc8cce4a747819f047/zubejunuxokuzidoduk.pdf
http://atlonnuri.org/UpLoadImage/editer/files/pazifez.pdf
https://robustbrakes.com/administrator/imagetemp/file/33777118540.pdf
http://contua.org/userfiles/file/ragedi.pdf
http://movietek.vn/hinh-anh/files/70912509245.pdf
https://efsanepin.com/calisma2/files/uploads/59630543527.pdf
http://studioscoponi.eu/userfiles/files/3351210119.pdf
https://uslugiinzynierskie.com/eurostyl/photos/file/rusiwalojinomunarap.pdf
https://fontaine-eva.fr/userfiles/files/tofigi.pdf
https://qualitycountscleaning.com/wp-content/plugins/super-forms/uploads/php/files/4c32660b00dd9dd208988e35987d198e/21906026545.pdf
http://folientastaturen.pl/_data/file/zidanugopilebuzodiwafufu.pdf

Embedded domains

feedproxy.google.com
noahmission.org
togeltop.net
serihosting.com
lotte-ppta.com
endobible.com
www.greenlakecruises.com
leeharringtonhomes.com
glycocalyx.nl
estatecambodia.com
originalavto.ru
weishinclinic.com
leicht-spb.ru
atlonnuri.org
robustbrakes.com
contua.org
efsanepin.com
studioscoponi.eu
uslugiinzynierskie.com
fontaine-eva.fr
qualitycountscleaning.com
folientastaturen.pl
nanchang.chinatupai.com
www.w3.org
purl.org

Embedded IP addresses

4.150.223.113
40.84.85.40
52.110.12.22
52.110.12.42
4.230.171.124
72.153.5.129
4.247.188.233
203.26.79.13
135.233.95.144
20.89.1.13
40.79.150.122
52.123.128.14
135.233.45.222
92.223.78.30
48.199.12.1
4.207.44.69
52.182.143.212
13.89.179.15
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report