MALICIOUS — 9cf635d5705dcdf1088d07a1d26d234eafeb4f590a34dd787dcfeb94394895b5
MALICIOUS — 9cf635d5705dcdf1088d07a1d26d234eafeb4f590a34dd787dcfeb94394895b5 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
9cf635d5705dcdf1088d07a1d26d234eafeb4f590a34dd787dcfeb94394895b5 - SHA-1:
9cb4a0f110d97d678efd04e86773a5790ca4a7cd - MD5:
dd86e539a5d622e7483929929908d41e - ssdeep:
1536:afdhat72RUo7eQm+X/SKtHJrce4xkXfjVnnjWypOlWWxpcb9M4:OU72RUo7ePy64JrcfWfxclD69M4 - TLSH:
T12B35C0F72093DD8C7ACF8B82EAAF239E85C5D7885663F5509148036DA16C97F7E10A40 - Submitted as: 9cf635d5705dcdf1088d07a1d26d234eafeb4f590a34dd787dcfeb94394895b5
- File type: pdf · Size: 60928 bytes
- Verdict: malicious (95/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 95/100 is the fusion of 6 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule
Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95 - Contacted 17 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://eatorhours.org/e-bussiness/fckimages/file/89018017492.pdf, https://asoriofrio.org/ckfinder/userfiles/files/nufikirugezuxexorobazoro.pdf, http://catwalkexotique.com/userfiles/batugivabuwogobutowa.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
5722 behavior events · 0 ATT&CK techniques · 2 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ntp.ubuntu.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787846485&P2=404&P3=2&P4=izsYRu4VfSdXOjfZYOkj8R1voBtli7YXA4IXl0dVZaOwNbTMv0UKOVybWd8%2bJ6i1fUiJhJSdQ58SfCLEC7GMtA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787846532&P2=404&P3=2&P4=GQDRy4fxE3b6KWsvSZ3G9%2bb3Srept5Oovx6ueKhco%2fRZv79S1QE0UZHDPRTFw5nXSoCcXT2nl0ZBqNHNoFch0w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
Dropped files
- C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt -
d33f9744db737f414b7d746fdb8a4cbaa28990744c196162ef4beeaef3712d10 - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- http://feedproxy.google.com/~r/Xvkpad/~3/4dZi1sgP-vI/uplcv?utm_term=atlanta+research+and+education+foundation
- https://eatorhours.org/e-bussiness/fckimages/file/89018017492.pdf
- https://asoriofrio.org/ckfinder/userfiles/files/nufikirugezuxexorobazoro.pdf
- http://catwalkexotique.com/userfiles/batugivabuwogobutowa.pdf
- https://pensiuneaselina.ro/userfiles/file/74444198083.pdf
- https://digireg.se/upload/tujomujenuvixokegefifoz.pdf
- https://nycsmindia.org/ckfinder/userfiles/files/korife.pdf
- https://varida-tech.com/ckfinder/userfiles/files/sozafoluris.pdf
- https://detskeihriska.eu/ckfinder/userfiles/files/wemutejarogawifixavaxome.pdf
- http://kwiatmetal.pl/userfiles/file/nosixozejomuladusadel.pdf
- http://eyela.kr/uploadfile/fckeditor/file/271940695.pdf
- http://circolosilverblufitnessclub.eu/userfiles/files/begefezufulixogeverebosu.pdf
- http://euskararenginkana.eus/files/galeria/files/repobotajerejebaj.pdf
- https://solener.info/ckfinder/userfiles/files/64295932359.pdf
- https://inprovitmexico.com/ckfinder/userfiles/files/27220067258.pdf
- https://cape-electronics.com/media/file/27992225187.pdf
- http://hzbmsj.com/images/upload/File/37204540795.pdf
- https://davnosti.ru/upload/43797346211.pdf
- https://nazrabilisim.com/calisma2/files/uploads/jabikefijuzulupeval.pdf
- http://bassonconsulting.mc/userfiles/file/xodinawewuk.pdf
- https://jdconstinc.com/ckfinder/userfiles/files/kejozidijutekadedemut.pdf
- http://doubler-son-capital.com/photos/files/fabavusefafajezafupezupi.pdf
- https://anzhero-sudzhensk.verlauf-ekb.ru/admin/ckfinder/userfiles/files/warakufas.pdf
- http://iamsong.vn/uploads/files/kejanoko.pdf
- https://szallas-karpatalja.hu/upload/46094649887.pdf
Embedded domains
- feedproxy.google.com
- eatorhours.org
- asoriofrio.org
- catwalkexotique.com
- digireg.se
- nycsmindia.org
- varida-tech.com
- detskeihriska.eu
- kwiatmetal.pl
- eyela.kr
- circolosilverblufitnessclub.eu
- solener.info
- inprovitmexico.com
- cape-electronics.com
- hzbmsj.com
- davnosti.ru
- nazrabilisim.com
- jdconstinc.com
- doubler-son-capital.com
- anzhero-sudzhensk.verlauf-ekb.ru
- videofilm-tv.ru
- ourgans.org
- pensiuneaselina.ro
- euskararenginkana.eus
- bassonconsulting.mc
Embedded IP addresses
- 72.153.5.129
- 172.66.2.5
- 52.110.12.48
- 52.230.60.54
- 4.230.171.124
- 85.210.193.152
- 135.232.92.97
- 20.76.201.171
- 74.178.240.61
- 52.123.128.14
- 172.178.240.161
- 72.153.5.141
- 203.26.79.13
- 20.42.65.91
- 92.223.78.30
- 4.209.250.170
- 52.148.114.188
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report