MALICIOUS — 9facec6c06cda28a0982c6dc6cafa31bc0ae62e5b45c85ca21da42732c73fa0c

MALICIOUS — 9facec6c06cda28a0982c6dc6cafa31bc0ae62e5b45c85ca21da42732c73fa0c is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 9facec6c06cda28a0982c6dc6cafa31bc0ae62e5b45c85ca21da42732c73fa0c
SHA-1: 1cd70206a137d7a936ea26532bf7892ac1002528
MD5: f1d8935bafec76cf03b78a0cc457b294
ssdeep: 1536:NFlxenG27Q2wuul9GVOMHs36nlv5/YPZjAOf+CjZWbpONiW+3fs2UUl09UEWe3D6:XKzulQ5MKvUL2AbNYkscUEj3u
TLSH: T1EA38C0F36197ED4C774A8F1374EB05A9608ED6886572EB60808CBA7CC87C5BDAF10611
Submitted as: 9facec6c06cda28a0982c6dc6cafa31bc0ae62e5b45c85ca21da42732c73fa0c
File type: pdf · Size: 80783 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://chiangmai-esc.net/user_img/files/10477479409.pdf - network signal, weight 0.70, confidence 0.80
Contacted 19 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://rjbmachinery.com/d/files/sujajivetemam.pdf, http://dolphinegypt.net/userfiles/file/59038412687.pdf, http://usmleworkout.com/files/file/newobabedesakazon.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9620 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787809269&P2=404&P3=2&P4=JiDzar4nOGUnX9zhIvqeiyllWI5X8AVanVlRfp7YEX3eFr29pFOGnP164TFKIYHMOuhUGgxqjE5gS644ve1C6g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787809330&P2=404&P3=2&P4=fLQ8Vz1wQ%2fnBsYBheKyud8ObF9dvI%2bZciHqbSUP4%2bo3t1KzHqGOaBnxV1o8hAnh2uTEieLy30HVkHhSorY7gsg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - b0ebd5da533f687420f051d19f4075d31596a700b9dddd57d844960442ed5220
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\86a6703ac5f61d93e3df38a23b0fa76a.png - 60f911d87e0cf89bd60a5d6d8b15682290873d1651af1ea6f5afd1adc466977c
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/skout/mBVl/~3/YTWXjIUwRh0/uplcv?utm_term=petronas+twin+towers+case+study+pdf
http://rjbmachinery.com/d/files/sujajivetemam.pdf
http://dolphinegypt.net/userfiles/file/59038412687.pdf
http://usmleworkout.com/files/file/newobabedesakazon.pdf
http://box8websites.com/ckfinder/userfiles/files/zamiruxopoz.pdf
http://chiangmai-esc.net/user_img/files/10477479409.pdf
http://kfnmdg.com/upfolder/e/files/20210624075441.pdf
https://tramtron.vn/uploads/files/files/33462243632.pdf
http://kondicionery-shodnya.ru/upload_picture/file/39502695426.pdf
http://problemconsulting.com/img/download/files/logebelon.pdf
https://speeddating.lt/speeddating/ckfinder/userfiles/files/75341413569.pdf
https://atlanthealth.com/wp-content/plugins/super-forms/uploads/php/files/3527c8ce8733365165f8626a6403fbdd/kugaderifuvusa.pdf
http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609b2fa54d80a---boridesukizorivokajovu.pdf
http://1000projects.ru/upload_picture/file/jawapoxesisefurinepat.pdf
https://www.synergyheart2heart.team/wp-content/plugins/super-forms/uploads/php/files/a1o4cokd3tiondocnknv2g2d3o/35282712094.pdf
http://agenziaimmobiliarecannavo.eu/userfiles/files/44361966621.pdf
https://www.coconutlodge.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d6169e13534---49262458815.pdf
http://prospekt-rostov.ru/ckfinder/userfiles/files/mukasenepuzuwalujag.pdf
https://alignerco.com/wp-content/plugins/super-forms/uploads/php/files/3acf0beae5712e9a8417972d32181617/23549649764.pdf
http://fontanarosaserigrafia.it/userfiles/file/lezavinibosoxulisetowukuf.pdf
http://dlikefulproductions.com/clients/875850/File/gipusedujag.pdf
https://naseeha.org/wp-content/plugins/super-forms/uploads/php/files/5a4088f7cf57545f22fc4ac828ed7001/44989929371.pdf
http://saopauloairporttransfers.com/ckfinder/userfiles/files/zezetoluloraroxiwuj.pdf
http://mikailang.net/userfiles/file/20210512085935_979574563.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

feedproxy.google.com
rjbmachinery.com
dolphinegypt.net
usmleworkout.com
box8websites.com
chiangmai-esc.net
kfnmdg.com
kondicionery-shodnya.ru
problemconsulting.com
atlanthealth.com
www.1000ena.com
1000projects.ru
agenziaimmobiliarecannavo.eu
www.coconutlodge.com
prospekt-rostov.ru
alignerco.com
fontanarosaserigrafia.it
dlikefulproductions.com
naseeha.org
saopauloairporttransfers.com
mikailang.net
www.w3.org
purl.org
ns.adobe.com
tramtron.vn

Embedded IP addresses

40.84.97.4
162.159.142.9
13.89.179.15
52.123.252.235
4.247.188.224
52.110.12.2
52.110.12.56
4.230.171.124
125.56.205.105
135.233.95.144
40.79.150.123
52.123.128.14
20.42.65.85
52.123.252.238
72.153.5.134
203.26.79.13
52.123.252.192
20.184.175.2
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report