MALICIOUS — 9aae7ffed95d144a4e51d8d3a8f79745af448eb52f7515592617d0a3d002a31c

MALICIOUS — 9aae7ffed95d144a4e51d8d3a8f79745af448eb52f7515592617d0a3d002a31c is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 9aae7ffed95d144a4e51d8d3a8f79745af448eb52f7515592617d0a3d002a31c
SHA-1: 66254416041c79a2f4567b1cce7d3b47cccd9cca
MD5: e083d6d13654aff7f82b05ad79a724aa
ssdeep: 1536:qHT1TTYwqeIckch5MVpSQALSKE3Kx52KKnyCMsDk+WCuPA7nBfjQWXLyT60bGAWq:E1HMTUuVbnI7K/kJ47igL0hbGbRw
TLSH: T1A539C0F7215BDC4C7A49AB037A6B12DCB186DB887122EB60948876ACC47C5FE7F00951
Submitted as: 9aae7ffed95d144a4e51d8d3a8f79745af448eb52f7515592617d0a3d002a31c
File type: pdf · Size: 86050 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://dancephoto.ru/userfiles/files/diwozorusovemugivewafota.pdf - network signal, weight 0.70, confidence 0.80
Contacted 15 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://ascii.tn/web/cgi/file/5111941686.pdf, https://oancora.com/ckfinder/files/pevugozu.pdf, http://limeitec.com/upfiles/editor/files/49256883656.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9681 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787819775&P2=404&P3=2&P4=RtJMAzK6NK1u5lQrnMBtIupmLOtZPLuo8em3RrCxbOz%2fjOmf8Yxjf5XW44%2fZUbRLYeVnrCQ9KADLWRLjvpc1hw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\c7a9dd9077f3a4175c10b4abe60c9e6e.png - bd17afbc4f9d960beab1029b7e320c4263ae38817dfb352d8e6e3e583c6210f9
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 71c68a4ea28e1d2e06d48d213d2ca10a45e948f3477170a70872a419d26bfaf3
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/skout/mBVl/~3/fzgW7-mxBc0/uplcv?utm_term=new+amsterdam+couchtuner
https://ascii.tn/web/cgi/file/5111941686.pdf
https://oancora.com/ckfinder/files/pevugozu.pdf
http://limeitec.com/upfiles/editor/files/49256883656.pdf
http://agrion.org/upload/fichier/75722468859.pdf
https://cristalensi.com/public/File/90336601366.pdf
http://tipsclubcr.com/campannas/file/betezilano.pdf
http://uktohabbarijamalta.com/files/file/vuzerelinetolo.pdf
http://halongwave.com/userfiles/file/warejuwosumiguda.pdf
https://piauiaqui.com/ckfinder/files/sumomegamavev.pdf
http://dancephoto.ru/userfiles/files/diwozorusovemugivewafota.pdf
http://hurtowniagrafit.pl/userfiles/file/50452531748.pdf
https://patriot.ch/wp-content/plugins/super-forms/uploads/php/files/o29vad0l1jkks0mov8aka4s1rk/rugalofiwexesulibenajed.pdf
http://celeb.huh.hu/UserFiles/File/gopepunolosuzuj.pdf
http://fixmyhelicopter.com/project-new/christianbook/upload_images/file/givefokov.pdf
http://keyday.ru/files/files/xesefosuripubewux.pdf
http://prodesign31.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1614970d18f8a5---77397308062.pdf
https://hotellemaritime.com/hotel/upload/files/jibefovagesoma.pdf
http://boekenwinkelindex.nl/images/uploads/73573373167.pdf
https://lacausedeslivres.com/userfiles/file/jitena.pdf
https://korzayithalat.com/spot/admin/fckeditor/userfiles/file/36842328135.pdf
http://abwingsjanaf.com/uploads/files/44164487966.pdf
http://abwingscolley.com/uploads/files/sodazixijom.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/

Embedded domains

feedproxy.google.com
oancora.com
limeitec.com
agrion.org
cristalensi.com
tipsclubcr.com
uktohabbarijamalta.com
halongwave.com
piauiaqui.com
dancephoto.ru
hurtowniagrafit.pl
patriot.ch
fixmyhelicopter.com
keyday.ru
prodesign31.ru
hotellemaritime.com
boekenwinkelindex.nl
lacausedeslivres.com
korzayithalat.com
abwingsjanaf.com
abwingscolley.com
www.w3.org
purl.org
ns.adobe.com
ascii.tn

Embedded IP addresses

20.42.179.204
51.105.71.136
52.110.12.25
20.42.179.192
4.230.171.124
4.144.132.223
13.89.179.15
135.232.92.137
74.179.77.204
52.123.128.14
72.145.35.101
203.26.79.13
52.123.252.198
57.155.101.212
172.170.180.133

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report