MALICIOUS — 96f087b288027082f7ceaca99044e6eaf7aad581ba210c57b89ef1dd52ef627e

MALICIOUS — 96f087b288027082f7ceaca99044e6eaf7aad581ba210c57b89ef1dd52ef627e is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100). 4 of 54 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 96f087b288027082f7ceaca99044e6eaf7aad581ba210c57b89ef1dd52ef627e
SHA-1: bb2b5793ed42b2fe66df5fe0762f51f2c908d10e
MD5: 4eab97a6fde8b6cdd17f4d46ba08905e
ssdeep: 1536:ZAWM4ia91AkHe2GYIJt3MJWFB5qWYpO2+W699KV4PD7TGq:e4RwPmIvMJs5h28oiD7H
TLSH: T16637C0F3309BED4CB7869B43A9EA119CB446D2841176EF504088FBAC89BC87D7F14961
Submitted as: 96f087b288027082f7ceaca99044e6eaf7aad581ba210c57b89ef1dd52ef627e
File type: pdf · Size: 76308 bytes
Verdict: malicious (100/100)

Detections (4 of 54 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://zhatuogz.com/uploadfile/file/ribenetemopunironun.pdf - network signal, weight 0.70, confidence 0.80
Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 5 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://demkapi.com/resimler/files/94481537977.pdf, http://zhatuogz.com/uploadfile/file/ribenetemopunironun.pdf, https://oneremote.ru/wp-content/plugins/super-forms/uploads/php/files/8f36b3aec26d1bae41f0d5d542955909/dutizesosibezopeliv.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

990 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
c.pki.goog
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
desktop-hsgcbep._dosvc._tcp.local
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
23.40.52.209
162.159.142.9 US · San Francisco · AS13335 Cloudflare, Inc.

Dropped files

root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/LPIa9PGmDLg/uplcv?utm_term=physicochemical+properties+of+drinking+water%2Bpdf
http://demkapi.com/resimler/files/94481537977.pdf
http://zhatuogz.com/uploadfile/file/ribenetemopunironun.pdf
https://oneremote.ru/wp-content/plugins/super-forms/uploads/php/files/8f36b3aec26d1bae41f0d5d542955909/dutizesosibezopeliv.pdf
http://mamam.by/upload/File/file/7018318464.pdf
http://jevades.com/aircraft/fckimages/file/wefelomufuba.pdf
http://autoscuolecasetta.it/userfiles/files/bemodefasutojoz.pdf
http://braciszewska-klimek.pl/fck_files/file/53410476261.pdf
https://www.tzounakos-insurance.gr/ckfinder/userfiles/files/rovipijexagu.pdf
http://baschin-heizung.de/meineBilderAlbertGrundschule/file/15634636210.pdf
http://www.colegiometa.net/home/wp-content/plugins/formcraft/file-upload/server/content/files/160adb6b360e20---filokipejok.pdf
http://ingfrimale.com/userfiles/files/gugila.pdf
http://www.tobywells.org/media/fckdir/file/panevemasi.pdf
https://stef-nancy.fr/upload/document/tobigi.pdf
https://www.chinacimctrailer.com/wp-content/plugins/super-forms/uploads/php/files/2157dbafc5af761c9c32c0c3308f36fd/fulegatesavepeg.pdf
http://vipavtoufa.ru/wp-content/plugins/super-forms/uploads/php/files/295a6125ef6bfafd68099728ac82c2ee/84149418117.pdf
https://www.rath-catering.de/wp-content/plugins/formcraft/file-upload/server/content/files/160c8b6ff85345---rumusumun.pdf
http://inezorviskids.com/clients/37546/File/wukukonopalez.pdf
http://nd-58.ru/wp-content/plugins/super-forms/uploads/php/files/f7784d4bd3192f07eba07a14e8b95c25/98340963074.pdf
http://thm-holding.ru/wp-content/plugins/super-forms/uploads/php/files/623299d62f1f15c28be7a5db529e0e4c/80670103706.pdf
http://videoacceso.com/wp-content/plugins/formcraft/file-upload/server/content/files/1610d497c57545---85820158041.pdf
https://www.quatainvestimentos.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160eca0432cf6f---59426212097.pdf
http://frangarcia.eu/upload/file/bitogudibiruxabi.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/

Embedded domains

feedproxy.google.com
demkapi.com
zhatuogz.com
oneremote.ru
jevades.com
autoscuolecasetta.it
braciszewska-klimek.pl
baschin-heizung.de
www.colegiometa.net
ingfrimale.com
www.tobywells.org
stef-nancy.fr
www.chinacimctrailer.com
vipavtoufa.ru
www.rath-catering.de
inezorviskids.com
nd-58.ru
thm-holding.ru
videoacceso.com
www.quatainvestimentos.com.br
frangarcia.eu
www.w3.org
purl.org
ns.adobe.com
mamam.by

Embedded IP addresses

162.159.142.9
20.247.184.142
52.110.12.26
4.230.171.124
92.223.78.30

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report