MALICIOUS — 987a22fb163e2bd3af6cc9ba2bb103be9078427753a9d6f4db57aaca67fc9fba

MALICIOUS — 987a22fb163e2bd3af6cc9ba2bb103be9078427753a9d6f4db57aaca67fc9fba is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100). 5 of 54 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 987a22fb163e2bd3af6cc9ba2bb103be9078427753a9d6f4db57aaca67fc9fba
• SHA-1: c0fccb8972adf864c937b2ace4267f584de3938f
• MD5: 455a95d0d3c003306a7f386f2ac37177
• ssdeep: 1536:eyjcKVLPz55/yW7Ww3lqcQQmXzxFnPOLuVwoaPe7nPJPjuTp1t3On:TVLtZiw3nmXz3POLSraPqnPJPjuLt+
• TLSH: T15039D0F31097FD8CB78E7F0396DA015850969B4E2136EAA1118CF72CC4A85BF7E50A61
• Submitted as: 987a22fb163e2bd3af6cc9ba2bb103be9078427753a9d6f4db57aaca67fc9fba
• File type: pdf · Size: 86140 bytes
• Verdict: malicious (100/100)

Detections (5 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!455A95D0D3C0
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1105
• T1566.002

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated malicious by URL analysis: https://uploads.strikinglycdn.com/files/bc577ac8-901d-4bc4-a536-7cef82903f57/best_storyboard_app_android.pdf - network signal, weight 0.70, confidence 0.80
• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged PDF/Phish-FAB!455A95D0D3C0 (rule PDF/Phish-FAB!455A95D0D3C0) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
• Contacted 9 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://gimoguvi.ru/award?keyword=cardiomegaly+adalah+pdf, https://510adc33-753b-44c0-977e-8d34da8fcdd4.filesusr.com/ugd/5f4192_a83e355910a646cdae0dfdad22a4f8fd.pdf?index=true, https://8b7199fc-a029-4910-8138-caee300d1cbd.filesusr.com/ugd/da8f68_327d72d2f52746b2ba7feeb64a9bbf41.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

1005 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• desktop-hsgcbep._dosvc._tcp.local
• desktop-hsgcbep(1)._dosvc._tcp.local
• desktop-hsgcbep(2)._dosvc._tcp.local
• desktop-hsgcbep(3)._dosvc._tcp.local
• ntp.ubuntu.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl

Dropped files

• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://gimoguvi.ru/award?keyword=cardiomegaly+adalah+pdf
• https://510adc33-753b-44c0-977e-8d34da8fcdd4.filesusr.com/ugd/5f4192_a83e355910a646cdae0dfdad22a4f8fd.pdf?index=true
• https://8b7199fc-a029-4910-8138-caee300d1cbd.filesusr.com/ugd/da8f68_327d72d2f52746b2ba7feeb64a9bbf41.pdf?index=true
• https://uploads.strikinglycdn.com/files/bc577ac8-901d-4bc4-a536-7cef82903f57/best_storyboard_app_android.pdf
• https://60f6da8c-824c-4163-aae9-6195f2ac7ed4.filesusr.com/ugd/7f16bd_838ca300e8874517bf8fb9665273dfe9.pdf?index=true
• https://uploads.strikinglycdn.com/files/6ef4c3e2-8f5b-4066-b3ff-3d84298f0388/how_to_upload_images_on_google_photos.pdf
• https://uploads.strikinglycdn.com/files/ad7bfdc6-5d49-4a8a-a57b-26d94f7df86e/stihl_leaf_blower_bg56c_parts.pdf
• http://teachost.com/8116035794gnusy.pdf
• https://uploads.strikinglycdn.com/files/a9b9f841-3391-40fa-b9b6-b2343f2d15a6/3755211238.pdf
• https://uploads.strikinglycdn.com/files/a23733d5-d772-445e-8d45-b103575f94c8/what_does_the_bible_say_about_adultery_in_marriage.pdf
• https://cd753cf5-d90a-4073-9c55-931a76e81761.filesusr.com/ugd/8826df_af189a75ec4e481dab92bd904f2956e6.pdf?index=true
• https://s3.amazonaws.com/sepovutapakogaf/work_song_cannonball_adderley.pdf
• https://dd7ee03d-3646-4e01-a1e1-4c0a7e2c9e57.filesusr.com/ugd/d7ba0f_99f17ecdf9404577b04d1a0b208f70a9.pdf?index=true
• https://s3.amazonaws.com/pafexegud/ellipsis_7_tablet.pdf
• http://spiritstudio.ru/dufixazolupize43d9.pdf
• https://ce322291-b3da-4cc2-ae0f-523e25daec44.filesusr.com/ugd/4530da_f8279b2823704a23a262c104174b8195.pdf?index=true
• https://uploads.strikinglycdn.com/files/7657f5ef-05fd-4180-90b3-e59453ac46a7/zudifevubixabawenupumifi.pdf
• https://1a6defe7-92a0-4357-8a70-d3bce85d30c9.filesusr.com/ugd/385065_c24054b81f0a4763a69c1510dc1c3396.pdf?index=true
• http://bettermoneytips.com/bhavesh_joshi_full_hd_movie_filmywapl8k99.pdf
• https://874c0fd6-92eb-497b-905f-dc7ca4d2e287.filesusr.com/ugd/5ca7d4_2981604ff291430bac0b18c681f6be52.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/

Embedded domains

• gimoguvi.ru
• 510adc33-753b-44c0-977e-8d34da8fcdd4.filesusr.com
• 8b7199fc-a029-4910-8138-caee300d1cbd.filesusr.com
• uploads.strikinglycdn.com
• 60f6da8c-824c-4163-aae9-6195f2ac7ed4.filesusr.com
• teachost.com
• cd753cf5-d90a-4073-9c55-931a76e81761.filesusr.com
• s3.amazonaws.com
• dd7ee03d-3646-4e01-a1e1-4c0a7e2c9e57.filesusr.com
• spiritstudio.ru
• ce322291-b3da-4cc2-ae0f-523e25daec44.filesusr.com
• 1a6defe7-92a0-4357-8a70-d3bce85d30c9.filesusr.com
• bettermoneytips.com
• 874c0fd6-92eb-497b-905f-dc7ca4d2e287.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 72.145.35.97
• 20.184.175.1
• 52.110.12.56
• 172.215.188.232
• 4.230.171.124
• 74.178.240.51
• 20.42.73.24
• 85.210.196.11
• 51.104.15.252

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report