MALICIOUS — 99490715305.pdf

MALICIOUS — 99490715305.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 50 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 9ae2d09c40d11aab4a01f556e8f48bed7378dccc33ffdf09e417f7a368943bd1
SHA-1: 2deac510a4d205dbde1569c6f9b381233a208fbe
MD5: 428e7dbcfd8738c4cd979684d65ae59a
ssdeep: 1536:+5rjKiY1ZXu+7S3K9BM0zFQa6Kk1ohKx0kzp1dZZk19OFIAeTC6i4bWwREPotgys:sYxu33eH5yb2EqQdozAem67bHUb
TLSH: T1293AD0F3204BDD4C6EC29B07E5E6156D604AC7D87626CA8058D8B73CC4BC67E7E24921
Submitted as: 99490715305.pdf
File type: pdf · Size: 92808 bytes
Verdict: malicious (99/100)

Detections (4 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
Emsisoft (Emergency Kit): PDF.Spam.Heur.1

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Lazarus): root_.cache_dconf_user - dynamic signal, weight 0.80, confidence 0.90
Contacted 29 external host(s) at runtime (3 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://philabc.ru/uplcv?utm_term=kv+admission+details, https://sip7.pl/autoinstalator/sip7.online/wp-content/plugins/super-forms/uploads/php/files/df998907619fd5dafbc130ddb6d6943b/6069581094.pdf, http://www.rosabrockenhaus.ch/ckfinder/userfiles/files/89876517748.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9678 behavior events · 1 ATT&CK techniques · 4 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
searchapp.bundleassets.example
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
ntp.ubuntu.com
desktop-hsgcbep
250.255.255.239.in-addr.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
23.40.52.121

Dropped files

/opt/CAPEv2/storage/analyses/26070/files/1dc0485a394482e9a59fe5ae7079fd3e80d1a60a621d37c46f12de442aedcdfa - 1dc0485a394482e9a59fe5ae7079fd3e80d1a60a621d37c46f12de442aedcdfa
/opt/CAPEv2/storage/analyses/26070/files/9494f6dd0d156c7f12ca606182da3ab595d6214a9bb1f485a6fb6f2595dffbbe - 9494f6dd0d156c7f12ca606182da3ab595d6214a9bb1f485a6fb6f2595dffbbe
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
tmp_tmp.lrTKo8Ue8t - e388c634625428f22eb703526fe8be6618c6e00dfabc7fa410ceae07bb41849e

Embedded URLs

https://philabc.ru/uplcv?utm_term=kv+admission+details
https://sip7.pl/autoinstalator/sip7.online/wp-content/plugins/super-forms/uploads/php/files/df998907619fd5dafbc130ddb6d6943b/6069581094.pdf
http://www.rosabrockenhaus.ch/ckfinder/userfiles/files/89876517748.pdf
http://dabien.co.kr/wp-content/plugins/formcraft/file-upload/server/content/files/160afc5fc0a375---kulagix.pdf
https://www.hdontheroadnapoli.it/wp-content/plugins/formcraft/file-upload/server/content/files/16073935921784---699089652.pdf
http://apluskleaning.com/admin/images/file/nejok.pdf
http://mazurubezpieczenia.pl/zdjecia/fck/file/94246218873.pdf
http://adria-ex.com/images/blog//file/ferizira.pdf
https://hissekurban.com/resimler/files/dixukato.pdf
https://asaptransfers.co.uk/wp-content/plugins/super-forms/uploads/php/files/saha56brlsnhhmrtvbic4i8d07/45225407088.pdf
http://www.lugashotel.com/data/editorfile/gosatekadisuledimexasone.pdf
https://pasarantogel.com/contents//files/sazefosunolikofini.pdf
http://alisawedding.com/upload/users/files/pominedafi.pdf
https://sportli.co.il/wp-content/plugins/formcraft/file-upload/server/content/files/1608c8a0881eb9---57960484927.pdf
http://www.mkkdigital.pt/wp-content/plugins/formcraft/file-upload/server/content/files/1607fbcf487fec---jepiwoxagovatopifunazi.pdf
https://sailstudy.in/ckfinder/userfiles/files/gozawitofugugumi.pdf
http://iccj.jp/images/uploads/fckeditor/file/87486762720.pdf
http://www.cargeacrew.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160a98d3c9ee63---bupawuwimiwekilemuluf.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt

Embedded domains

philabc.ru
sip7.pl
sip7.online
www.rosabrockenhaus.ch
dabien.co.kr
www.hdontheroadnapoli.it
apluskleaning.com
mazurubezpieczenia.pl
adria-ex.com
hissekurban.com
asaptransfers.co.uk
www.lugashotel.com
pasarantogel.com
alisawedding.com
sailstudy.in
iccj.jp
www.cargeacrew.com.br
kvsonlineadmission.kvs.gov.in
www.w3.org
purl.org
ns.adobe.com
sportli.co.il
www.mkkdigital.pt

Embedded IP addresses

74.178.76.128
74.178.232.29
57.155.101.212
72.145.35.116
40.84.85.40
172.178.240.162
135.233.95.144
20.247.184.142
52.123.252.215
52.123.128.14
20.42.179.192
162.159.36.2
4.230.171.124

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report