MALICIOUS — 9bca3fcad3f0f5916b2375f5f54a6999aee40adc30c9241e83abc31fd74d3cdb

MALICIOUS — 9bca3fcad3f0f5916b2375f5f54a6999aee40adc30c9241e83abc31fd74d3cdb is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 9bca3fcad3f0f5916b2375f5f54a6999aee40adc30c9241e83abc31fd74d3cdb
SHA-1: 4aa1dd63e93df85eade69391254fadda2f81a8b2
MD5: bb84fb7f97f8f73a39c16388966901a8
ssdeep: 1536:zbnUkvgMr8ZEud9im6vrcj+/4TJ9dXHWGgN/sJhr4wxITV7CGiM:/nUkrkDu7vrYbrtW5BMZ4wYBuM
TLSH: T1DB37CFF3618BCC8C364A6F03AEB7225DA144C2997672936014C8BB7CD97877D7D20961
Submitted as: 9bca3fcad3f0f5916b2375f5f54a6999aee40adc30c9241e83abc31fd74d3cdb
File type: pdf · Size: 74604 bytes
Verdict: malicious (98/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!BB84FB7F97F8
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://uploads.strikinglycdn.com/files/c853d9d5-a776-4ed0-b9db-8b0f5f96c363/wawidotikazipam.pdf - network signal, weight 0.70, confidence 0.80
Contacted 18 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://smidgel.ru/pbw?utm_term=autopage+c3-rs+730+installation+manual, https://uploads.strikinglycdn.com/files/c853d9d5-a776-4ed0-b9db-8b0f5f96c363/wawidotikazipam.pdf, https://uploads.strikinglycdn.com/files/ae2c6599-694e-450a-872d-6dfdf087f5fa/redopegerowugoki.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (13 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9690 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
desktop-hsgcbep
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - c6338c99f6aae207bf0dfc53f763ec9010f98c47d2d7181a792f6e093e9d06a3
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\64a676653513934782572eccd697d088.png - 2a78de989ad46090b4f0bfc1a322f6910b53b79492246adbd1c77a4cf30b599b
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://smidgel.ru/pbw?utm_term=autopage+c3-rs+730+installation+manual
https://uploads.strikinglycdn.com/files/c853d9d5-a776-4ed0-b9db-8b0f5f96c363/wawidotikazipam.pdf
https://uploads.strikinglycdn.com/files/ae2c6599-694e-450a-872d-6dfdf087f5fa/redopegerowugoki.pdf
https://uploads.strikinglycdn.com/files/5e9c0c77-3eb5-4b8d-b8ee-47e97279d2db/mevodujibedibumilobedaj.pdf
https://fizobadajavene.weebly.com/uploads/1/3/4/4/134492874/498f7994c725.pdf
https://dopozagipixa.weebly.com/uploads/1/3/2/7/132741545/52c44155aa3a.pdf
https://uploads.strikinglycdn.com/files/a71846ec-b1c8-4f75-9ffd-917b5e9b8bb8/double_cross_algebra_with_pizzazz_page_129_answers.pdf
https://uploads.strikinglycdn.com/files/a621fe30-8506-4a74-870c-1ba3df58069a/future_english_for_results_4_teachers_edition.pdf
http://ruwezebom.pbworks.com/f/jlpt_n3_kanji_practice_sheets.pdf
https://cdn-cms.f-static.net/uploads/4449996/normal_60271565263fe.pdf
https://cdn-cms.f-static.net/uploads/4418777/normal_6014dec814160.pdf
https://uploads.strikinglycdn.com/files/867a19da-3e44-4a17-8000-e4248cb516b8/lorasefewopade.pdf
https://static.s123-cdn-static.com/uploads/4471995/normal_5fddb46170ca8.pdf
http://pebokuvog.pbworks.com/f/xbox_one_jailbreak_usb_download.pdf
https://fofevupug.weebly.com/uploads/1/3/4/4/134490210/7871192.pdf
https://uploads.strikinglycdn.com/files/41d22291-3c7b-4c14-9f33-430afaadac14/32564573708.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

smidgel.ru
uploads.strikinglycdn.com
fizobadajavene.weebly.com
dopozagipixa.weebly.com
ruwezebom.pbworks.com
cdn-cms.f-static.net
static.s123-cdn-static.com
pebokuvog.pbworks.com
fofevupug.weebly.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

20.184.175.3
162.159.142.9
20.184.175.14
52.123.252.239
52.110.12.21
4.230.171.124
4.144.132.114
74.178.240.61
135.232.92.97
52.123.129.14
40.99.133.226
52.123.252.229
72.154.7.16
203.26.79.13
52.123.252.203
40.84.85.40
92.223.78.30
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report