MALICIOUS — 957a3551cf4ba3d468eeb423de6afb72cc7a0d65ea72c4a6e52a4e8f2aa1cd29

MALICIOUS — 957a3551cf4ba3d468eeb423de6afb72cc7a0d65ea72c4a6e52a4e8f2aa1cd29 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 957a3551cf4ba3d468eeb423de6afb72cc7a0d65ea72c4a6e52a4e8f2aa1cd29
SHA-1: 33621a2305f62cab5280c0458a869ad685f15e42
MD5: d134829bbdbeeffb24802f50bbedcd6e
ssdeep: 1536:DU0SEHw/7oRYUaYqrW7vGrWt7PEPTMNZLWUpO7zk2EaUnHr:xw/8wrOIPTMNZe7g3DL
TLSH: T16537AEF350EBDE8C779F9B0379EA026D6141E2885172FA604188767CC5BCABE6E10641
Submitted as: 957a3551cf4ba3d468eeb423de6afb72cc7a0d65ea72c4a6e52a4e8f2aa1cd29
File type: pdf · Size: 74891 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://radiopoint.cz/userfiles/file/kuniziwifebutuger.pdf - network signal, weight 0.70, confidence 0.80
Contacted 16 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://fw-simple.com/uploads/files/7123483258.pdf, https://www.frontierexim.com/wp-content/plugins/super-forms/uploads/php/files/1d813iqvubdp2p4gcdde1k4vc1/64614596978.pdf, http://theponghop.com/upload/files/tajemuvusipigujoxel.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9620 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787939792&P2=404&P3=2&P4=kkKQZtyFr5iMQyfcx%2bHYxCaLllMrgVBzu3YKy5J6ZUsZ7HihYWh2e8a0JF8tIHX3%2bCJsj5xZDYeHAGi1aFIr8A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787939822&P2=404&P3=2&P4=LuYjWr9SGKUuCiccIOGhVcJzh1PuvJtfrxphIyLDuqUKt%2ffvOnYuZxNiR5%2bmyA3leaUnGdYOw%2f21yglPIz%2fD7A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787336458&P2=404&P3=2&P4=JX3le7z2OST%2bdcQa4voIDNrncrXjb6ARB861ElU%2fx7X5F1vZbmpe33XHsDEQcfMAHWR%2fYOgjgio%2buS0fZgLEzQ%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\7e00499cbbc24374289fdc30ed326e24.png - f3b3579983f4b85f7274147da1888dda370df819c1e42195060cebf664c4bb35
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 25e7e477dc1312f15cd5b374f8d545963a1a72b9f5c3f7f898aea45859aa1dd9
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/skout/mBVl/~3/zMnd8XtcwSM/uplcv?utm_term=ultimate+car+simulator+mod+apk
http://fw-simple.com/uploads/files/7123483258.pdf
https://www.frontierexim.com/wp-content/plugins/super-forms/uploads/php/files/1d813iqvubdp2p4gcdde1k4vc1/64614596978.pdf
http://theponghop.com/upload/files/tajemuvusipigujoxel.pdf
https://hotelite.in/userfiles/file/mexipexevonawuwoxosi.pdf
http://radiopoint.cz/userfiles/file/kuniziwifebutuger.pdf
http://www.photonics-science.com/ckfinder/userfiles/files/bisamezapokapuxolemu.pdf
http://yucehukuk.com/resimler/files/78333897699.pdf
http://tootingtaxi.com/survey/userfiles/files/38094980284.pdf
http://sportsgarten.com/editorData/file/46226771207.pdf
http://rdasesores.gestconcursal.com/editor/ckfinder/userfiles/files/57098948816.pdf
https://hophamthaibinh.com/upload/files/filububivuguxopuliga.pdf
http://www.bash.cl/media/file/65968844741.pdf
http://77owship.netsociality.com/upload/files/josabozin.pdf
https://pactforfamilies.org/ckfinder/userfiles/files/zanusamepoxa.pdf
http://eaupureinternational.com/userfiles/file/44658659850.pdf
https://semot.com/Store/userfiles/file/61099280296.pdf
http://www.truca-taoules.com/ckfinder/userfiles/files/15213960681.pdf
http://klhl.com/userfiles/file/48241223150.pdf
https://intrigantka.ru/images/userfiles/file/nejiriribokupovo.pdf
https://www.adoz.cz/ckfinder/userfiles/files/punigatujemudofomimijakib.pdf
http://www.vljainandco.com/userfiles/files/jukevirigazisivolute.pdf
https://anukulagrotech.com/ci/userfiles/files/57705596437.pdf
https://tecnibat.net/uploads/archivos/suvelajuzubuzelumusemuv.pdf
https://eurosan.pl/user_images/file/paxopagejidutekawodijo.pdf

Embedded domains

feedproxy.google.com
fw-simple.com
www.frontierexim.com
theponghop.com
hotelite.in
www.photonics-science.com
yucehukuk.com
tootingtaxi.com
sportsgarten.com
rdasesores.gestconcursal.com
hophamthaibinh.com
77owship.netsociality.com
pactforfamilies.org
eaupureinternational.com
semot.com
www.truca-taoules.com
klhl.com
intrigantka.ru
www.vljainandco.com
anukulagrotech.com
tecnibat.net
eurosan.pl
solar-makernavi.com
www.w3.org
purl.org

Embedded IP addresses

104.208.16.94
52.110.12.33
57.155.104.224
4.230.171.124
51.105.71.136
40.103.64.226
52.123.129.14
52.123.128.14
40.103.64.242
52.123.252.192
72.154.7.96
203.26.79.13
52.123.252.216
74.178.76.128
172.175.111.170
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report