MALICIOUS — lezunipo.pdf

MALICIOUS — lezunipo.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 984543f7f500bc88626667daf57e400ec2602adc51c9a5b4bd508ab3e9f24809
SHA-1: 47c76d1341bb7c617a4b3a298c85c0bf3f21ecb4
MD5: 07b11beb499956aeead1c7f80b05b404
ssdeep: 1536:r7iF4+OZ1K3I+DzWzZM5Qdpo7B/fq3WxApOGzWTfNkJGR9itjGB/g9Fx22:KF++gK5QdOp/3Gyfd9itaBI9
TLSH: T1DC39C1F36097CE4C7A8A8F0766EB11AC648BE3886163EA5044C8F67DE4BC5BD7E00551
Submitted as: lezunipo.pdf
File type: pdf · Size: 84622 bytes
Verdict: malicious (99/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://labotinnghia.com/img/files/mosijesuze.pdf - network signal, weight 0.70, confidence 0.80
Memory forensics: 4 finding(s), e.g. RWX/private injected region in SumatraPDF.exe (pid 9164) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Contacted 21 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://ferropula.hr/files/31991290994.pdf, http://vagtteam.dk/userfiles/Files/fetebidikeduripuzunow.pdf, http://labotinnghia.com/img/files/mosijesuze.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9625 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
desktop-hsgcbep
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
79.243.254.169.in-addr.arpa
255.255.254.169.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - bb6bd8fe0242c508a7f773e10cf3d5b1b2142e39662840eaa0674451c4d5c05d
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\42fb7a94198cb53926bac36eb2192230.png - 8dacad99e42988d0d1c4ed368e26a04422c79c7cb1bd6dab1e9a2cd48047fc04
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/BkSY9tpko7c/uplcv?utm_term=among+us+download+full+version
https://ferropula.hr/files/31991290994.pdf
http://vagtteam.dk/userfiles/Files/fetebidikeduripuzunow.pdf
http://labotinnghia.com/img/files/mosijesuze.pdf
http://www.barankayalar.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/1614275bdf01be---zaterotuj.pdf
http://czechnews.cz/userfiles/files/susuzoza.pdf
https://aimhc.com/userfiles/file/70224325171.pdf
http://oticonshop.com/ckfinder/userfiles/files/lojadupawixijuxojojid.pdf
https://isosklo.cz/uploads/zolabavalema.pdf
http://tomboy2.com/images/library/File/lobefos.pdf
https://www.mclarenpress.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613e0dff1d0e2---85835997873.pdf
https://ganport.pl/userfiles/file/25731941304.pdf
http://hoanggiaphatland.com/uploads/image/files/87360297011.pdf
http://www.udelimpa.es/ckfinder/userfiles/files/rojam.pdf
https://mission4recruitment.com/wp-content/plugins/formcraft/file-upload/server/content/files/16137f0bb14e1c---42547815997.pdf
https://www.die-umzugsfabrik.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614504a471f36---75182270091.pdf
https://www.baptistenhardenberg.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16131b32aedc7b---xinowukefatizaza.pdf
http://www.frank-diagn.hu/userfiles/files/zavawegazibar.pdf
https://madeinstlucia.com/userfiles/files/basemamojotuxeloko.pdf
https://burgas-remonti.com/userfiles/file/66561795747.pdf
http://bhk-aindling.de/userfiles/files/bavinigelowamujiguwo.pdf
https://duproject.com/uploadEditor/files/togisoz.pdf
https://niagarablock.com/application/webroot/userfiles/file/4795398935.pdf
http://www.gametimecatering.com/wp-content/plugins/formcraft/file-upload/server/content/files/16141ac7db13d8---16243241544.pdf
https://jagamimpi.info/contents/files/ragoz.pdf

Embedded domains

feedproxy.google.com
labotinnghia.com
aimhc.com
oticonshop.com
tomboy2.com
www.mclarenpress.com
ganport.pl
hoanggiaphatland.com
www.udelimpa.es
mission4recruitment.com
www.die-umzugsfabrik.com
www.baptistenhardenberg.nl
madeinstlucia.com
burgas-remonti.com
bhk-aindling.de
duproject.com
niagarablock.com
www.gametimecatering.com
jagamimpi.info
nieruchomoscikomercyjne.co
www.holderit.com
freshchannels.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

172.172.255.217
20.42.73.27
20.184.175.3
135.232.92.137
20.42.65.89
51.116.253.169
52.110.12.16
48.211.4.16
4.230.171.124
20.165.94.54
20.165.94.63
52.123.129.14
92.223.78.30
72.145.35.110
203.26.79.13
52.123.252.202
20.184.175.12
172.175.111.170
52.148.114.188
142.251.222.227
74.178.76.44

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report