MALICIOUS — 990cf440b84fd8355505951ae531ec1c0bb4ed2ba5449d2972fdc208efe6e186

MALICIOUS — 990cf440b84fd8355505951ae531ec1c0bb4ed2ba5449d2972fdc208efe6e186 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 990cf440b84fd8355505951ae531ec1c0bb4ed2ba5449d2972fdc208efe6e186
SHA-1: 5e574672876a5cf467d42795e12e1b4a8a5bccf0
MD5: 45ed27e469b30e89d69e329ea78c994c
ssdeep: 1536:FpeByuMpC24ytyMd9c0dNDmWYRO9PY+mKoZWWkNpOPaWVfz6XHZc+PE:ejkt5lJ/9P07P3z6e5
TLSH: T1B038C0F32167DD8C774B8F4739F61268A449D78D5262EB901088B37C84BCAFD7A28950
Submitted as: 990cf440b84fd8355505951ae531ec1c0bb4ed2ba5449d2972fdc208efe6e186
File type: pdf · Size: 79120 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 15 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://nathulaldasptti.com/ckeditor/ckfinder/userfiles/files/famudopotulorojazidogo.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://israelonthehouse.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613bd975af356---28912515505.pdf, http://nathulaldasptti.com/ckeditor/ckfinder/userfiles/files/famudopotulorojazidogo.pdf, http://jiehuist.com/userfiles/files/37087357575.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9761 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
desktop-hsgcbep
250.255.255.239.in-addr.arpa
desktop-hsgcbep._dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\8c376f378edef0c7ddfa151ed409f839.png - 69f7be72062e8a9c43110715300a5e8b1e22a4f8721f73e2cac7fd67e7056c0d
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - ce46a4ebbb7b2cadb4a52c40659bfc64316858fef94484fb271c79cdf48e85a5
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/skout/mBVl/~3/fzgW7-mxBc0/uplcv?utm_term=car+parking+simulator+money+hack
https://israelonthehouse.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613bd975af356---28912515505.pdf
http://nathulaldasptti.com/ckeditor/ckfinder/userfiles/files/famudopotulorojazidogo.pdf
http://jiehuist.com/userfiles/files/37087357575.pdf
http://travelbilet.ru/sites/default/files/file/87440332286.pdf
https://caribemed.com/userfiles/file/mikazivupuxarojewi.pdf
http://adanateknikservis.web.tr/wp-content/plugins/formcraft/file-upload/server/content/files/16144835464283---59675748596.pdf
http://czdashan.cn/uploadfile/file/2021090505152673499.pdf
https://gencerenerji.com/resimler/files/77657292772.pdf
https://www.hotelamoha.it/wp-content/plugins/formcraft/file-upload/server/content/files/161320baeaee7b---53553186915.pdf
http://ddaengshop.com/ckupload/files/35797831310.pdf
https://rebates.forex/wp-content/plugins/super-forms/uploads/php/files/vbcb33vf1d0aulcj2cjlmaes30/mevip.pdf
http://denkobarbell.com/_upload/files/jererodupakakotazufu.pdf
https://landtop.com/filespath/files/20210909150101.pdf
http://lonerangerfanclub.com/ckfinder/userfiles/files/63065933396.pdf
http://atol-res.pl/uploads/file/derogaberosi.pdf
http://myucpb.com/userfiles/file/pafevapujepulekoxasoxal.pdf
https://censcakmu.org/board/file/files/6560240352.pdf
http://tomgiongvip.com/uploads/files/file/68711497709.pdf
http://www.feniuniversity.edu.bd/app/webroot/ckfinder/userfiles/files/koxaxozi.pdf
http://santeh.md/img/files/butogomunujosukezigepo.pdf
https://www.sussexweddingservices.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1613a04ebc0bc9---lusavovo.pdf
https://ceccargiurgiu.ro/userfiles/file/pegeda.pdf
http://kool-house.com/upload/editor/file/zujumetag.pdf
http://homespakistan.net/magzine/uploadfiles/file/73719277647.pdf

Embedded domains

feedproxy.google.com
israelonthehouse.com
nathulaldasptti.com
jiehuist.com
travelbilet.ru
caribemed.com
czdashan.cn
gencerenerji.com
www.hotelamoha.it
ddaengshop.com
denkobarbell.com
landtop.com
lonerangerfanclub.com
atol-res.pl
myucpb.com
censcakmu.org
tomgiongvip.com
www.sussexweddingservices.co.uk
kool-house.com
homespakistan.net
www.w3.org
purl.org
ns.adobe.com
adanateknikservis.web.tr
rebates.forex

Embedded IP addresses

20.42.179.204
172.172.255.217
4.150.223.101
4.230.171.124
40.84.97.4
4.144.132.223
20.165.94.63
135.233.95.135
135.232.92.137
52.123.129.14
74.178.232.29
203.26.79.13
13.89.179.12
48.199.12.1
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report