MALICIOUS — 986c77cfedc12e18a9c36d4c55a519c792473369af49f049795e7b19d4f037df

MALICIOUS — 986c77cfedc12e18a9c36d4c55a519c792473369af49f049795e7b19d4f037df is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 986c77cfedc12e18a9c36d4c55a519c792473369af49f049795e7b19d4f037df
SHA-1: 9417cd7268d716246cba900fc1fc71492f749e94
MD5: 54740dae495aa9c98282cc787d6176c4
ssdeep: 1536:5eJhNnDxK57tbVWtv/A1r/q5HIQaYRnZNLKoqnnjbodxZeG:shtDxK7t4hary5H5aYRnZhKo/dH
TLSH: T15738CFF3109BDE4C7A8B5B03BEA3226DA06AD64D7133971001C86B5CC67CAAE7F51581
Submitted as: 986c77cfedc12e18a9c36d4c55a519c792473369af49f049795e7b19d4f037df
File type: pdf · Size: 78728 bytes
Verdict: malicious (96/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!54740DAE495A
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Contacted 20 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://cdn-cms.f-static.net/uploads/4490539/normal_605ef37012185.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://nipisod.ru/strik?utm_term=vw+repair+centre+near+me, https://cdn-cms.f-static.net/uploads/4490539/normal_605ef37012185.pdf, http://dlkmvkoenv.info/bisivetalobewobe7sp0s.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9693 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 38dec9ae6217e8ac45aafc6af64538573aec21d6d52a93d80bbf4c4d8775e603
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\fc2553e28d7fc28e1714d44f9de2b56f.png - 2a0577a509bbe0c5b9564f1ed8349896d40bb2dd174247d177d1b0f998d53ad7
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://nipisod.ru/strik?utm_term=vw+repair+centre+near+me
https://cdn-cms.f-static.net/uploads/4490539/normal_605ef37012185.pdf
http://dlkmvkoenv.info/bisivetalobewobe7sp0s.pdf
https://s3.amazonaws.com/lazolu/wwe_3d_games_for_mobile.pdf
http://gonapubofolok.epizy.com/how_to_repair_kenmore_dryer_timer.pdf
https://9e1e9198-0fe7-4103-8084-fdcc6befb8d5.filesusr.com/ugd/2f7815_dcea1db343054c058182abe9fa68f6fa.pdf?index=true
https://cdn-cms.f-static.net/uploads/4425759/normal_605f9bbfcdda6.pdf
https://s3.amazonaws.com/voxulija/ruwifovovulisapiv.pdf
http://iuts.space/pebewigujasanavizerdhaih.pdf
http://changepass.online/ukulele_strumming_patterns_4_4d4fg6.pdf
http://lepoxas.rf.gd/27503555255.pdf
http://kostlike.site/police_request_cctv_footage_form5ea67.pdf
https://s3.amazonaws.com/bulozor/iata_agent_code_format.pdf
http://sarupisegov.rf.gd/what_position_is_best_for_menstrual_cramps.pdf
http://gbarb.me/mean_arterial_pulse_pressure_calculationsg62u.pdf
https://6e7ef639-f89a-4701-86f9-710a836f1183.filesusr.com/ugd/12745a_96537e8a281143f8885d90cf73ddee14.pdf?index=true
https://cdn-cms.f-static.net/uploads/4415077/normal_5fd9a1cb46a1b.pdf
http://kitoxez.epizy.com/83316051190.pdf
https://s3.amazonaws.com/vasofirida/lineage_2_revolution_class_guide.pdf
http://dexegesen.rf.gd/lasko_box_fan_replacement_feet.pdf
https://static.s123-cdn-static.com/uploads/4455207/normal_5fcc8175ec194.pdf
https://cdn-cms.f-static.net/uploads/4385880/normal_60209ea8b5613.pdf
http://lamuzanumezaw.rf.gd/nexevefasivizo.pdf
http://zupotid.epizy.com/856140428.pdf
http://tefosewun.22web.org/fenujun.pdf

Embedded domains

a.org
nipisod.ru
cdn-cms.f-static.net
dlkmvkoenv.info
s3.amazonaws.com
gonapubofolok.epizy.com
9e1e9198-0fe7-4103-8084-fdcc6befb8d5.filesusr.com
iuts.space
changepass.online
kostlike.site
gbarb.me
6e7ef639-f89a-4701-86f9-710a836f1183.filesusr.com
kitoxez.epizy.com
static.s123-cdn-static.com
zupotid.epizy.com
tefosewun.22web.org
www.w3.org
purl.org
ns.adobe.com
lepoxas.rf.gd
sarupisegov.rf.gd
dexegesen.rf.gd
lamuzanumezaw.rf.gd

Embedded IP addresses

4.150.223.105
162.159.142.9
51.132.193.104
135.232.92.34
52.110.12.32
4.230.171.124
72.153.5.140
203.26.79.13
52.253.84.76
135.232.92.97
20.112.250.133
20.165.94.63
52.123.129.14
172.178.240.161
4.150.223.101
20.42.65.93
135.233.95.144
48.192.143.121
20.52.64.201
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report