MALICIOUS — 976fe0ec9d86a0b0eeff65af56921f6d615ae942186dd88271ce5151b7449a29

MALICIOUS — 976fe0ec9d86a0b0eeff65af56921f6d615ae942186dd88271ce5151b7449a29 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 976fe0ec9d86a0b0eeff65af56921f6d615ae942186dd88271ce5151b7449a29
SHA-1: 1b808cf2a49b22944d561eb30e3e1ad918f1c272
MD5: eb35c7d2b076ba309a6ef0fd6a142ac4
ssdeep: 1536:dn5bOIDIKGdwHgKG0y6B4OfL5huXG3E6pxjrWLLiUNKWCpOVicE3tH+:toUI9d/KljB4OD02E6biHVix3Q
TLSH: T18D36D0F37097DD9C37DBAB5369AA116DA04AC3482026EB50018CB7ADC87C57EAF04E51
Submitted as: 976fe0ec9d86a0b0eeff65af56921f6d615ae942186dd88271ce5151b7449a29
File type: pdf · Size: 69143 bytes
Verdict: malicious (95/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 95/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Contacted 16 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://centrobrands.com/wp-content/plugins/super-forms/uploads/php/files/0019057aee9bb02da8111d7a7708f668/busuk.pdf, https://happycustomerservice.com/wp-content/plugins/super-forms/uploads/php/files/17c050a0f465b4f757ee34e4314fb459/jutukewuveziporowuz.pdf, https://netlandschool.cl/files/buwalavotuborabipevaso.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9709 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - aa4417ec3dbdc63bbc964613977a61e77689f24391313d389ee24224ebbd4563
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\6d296a07480569d4470d72748dfdd584.png - 43ea51b4ead30293de9d665bcd7f4321c260792d2f8ff09f8841deb476b3fb8d
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/skout/mBVl/~3/Om9ozkHLxGw/uplcv?utm_term=the+gothic+tarot+compendium+pdf
https://centrobrands.com/wp-content/plugins/super-forms/uploads/php/files/0019057aee9bb02da8111d7a7708f668/busuk.pdf
https://happycustomerservice.com/wp-content/plugins/super-forms/uploads/php/files/17c050a0f465b4f757ee34e4314fb459/jutukewuveziporowuz.pdf
https://netlandschool.cl/files/buwalavotuborabipevaso.pdf
http://mrbossamktown.com/uploads/files/21954254079.pdf
https://frennphotography.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b43844f4182---bimizurekafiwa.pdf
http://www.jesuseslaroca.org/wp-content/plugins/formcraft/file-upload/server/content/files/160738011be2f7---wikitugop.pdf
http://aeskulap24h.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ab0c84f7e6---19993269383.pdf
http://kolesnikov.pro/ckfinder/userfiles/files/famosidoludobunomepaje.pdf
http://www.liveartsaskatchewan.com/wp-content/plugins/formcraft/file-upload/server/content/files/160cfa64843992---pamedigavizisewi.pdf
http://nanopena.cz/upload/file/jilugozavofazojitef.pdf
http://cpgny.com/userfiles/files/9046101968.pdf
http://subventionsbetrug.de/wp-content/plugins/super-forms/uploads/php/files/9da3g11qd36j6o0d6k8b98p484/33805537244.pdf
http://ei-windykacja.pl/upload/file/84843372861.pdf
http://dgone.kr/userfiles/file/20210822071154.pdf
https://vanchuyenduongsat.vn/upload/files/982645124.pdf
http://www.onekaddy.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c7ab51dfa05---wulewukaku.pdf
http://www.hkqi.com/wp-content/plugins/formcraft/file-upload/server/content/files/16085573b9c008---18284703646.pdf
https://gujaratisamajparis.org/upload/files/tesoratelikupuku.pdf
http://pnmanagementsolutions.in/uploads/fezutivasitelajapaxanegi.pdf
http://www.ecostroyservis.ru/File/lamowi.pdf
https://mattweidnerlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bb4bfe8bf6e---logebovolu.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/

Embedded domains

feedproxy.google.com
centrobrands.com
happycustomerservice.com
mrbossamktown.com
frennphotography.com
www.jesuseslaroca.org
aeskulap24h.com
kolesnikov.pro
www.liveartsaskatchewan.com
cpgny.com
subventionsbetrug.de
ei-windykacja.pl
dgone.kr
www.onekaddy.com
www.hkqi.com
gujaratisamajparis.org
pnmanagementsolutions.in
www.ecostroyservis.ru
mattweidnerlaw.com
www.w3.org
purl.org
ns.adobe.com
netlandschool.cl
nanopena.cz
vanchuyenduongsat.vn

Embedded IP addresses

172.215.188.232
52.110.12.26
4.230.171.124
74.179.71.159
4.144.132.114
72.154.7.106
203.26.79.13
135.232.92.97
135.232.92.137
20.231.239.246
20.42.65.88
52.123.128.14
13.69.116.104
172.175.111.170
92.223.78.30
51.132.193.105

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report