MALICIOUS — 9faecf96674cdd041282130651c721a815b9a7096b79beaa5a1b7239b83bbc3d

MALICIOUS — 9faecf96674cdd041282130651c721a815b9a7096b79beaa5a1b7239b83bbc3d is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 9faecf96674cdd041282130651c721a815b9a7096b79beaa5a1b7239b83bbc3d
SHA-1: 05870cd7825ad25661761f0e9ce3bdb7d403679d
MD5: ab58d6b54704df5f3c617b3716549297
ssdeep: 1536:GWZXC57U7t36AAvXkGSYgXlCRq45WK0/k/GIZWbpONYtH:ZXkUR36AeWlXlCRq4ccOIbNm
TLSH: T1C337CFF31097FC4C775BDF4379EB5169B44AC38861B2EB608488AA6CC57C57E6E04A40
Submitted as: 9faecf96674cdd041282130651c721a815b9a7096b79beaa5a1b7239b83bbc3d
File type: pdf · Size: 69693 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://eca.or.th/ckfinder/userfiles/files/zisimomowiza.pdf - network signal, weight 0.70, confidence 0.80
Contacted 16 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://huntic.ru/uplcv?utm_term=clinical+microbiology+textbook+pdf, https://gpuhub.net/wp-content/plugins/super-forms/uploads/php/files/c0e4ffr8kvs7d5adf0vrbjsp63/63386272285.pdf, https://ceramicasvillaflor.cl/UserFiles/File/wemugazomariw.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9573 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787840158&P2=404&P3=2&P4=FOYFPPHPIijU8y6Qg%2bIzsq6VjtsK50spSzYU6dKKvOvQfaGVI3xNHB8buiFdhSuNkRzOOIxgPQfSBSdTDj9eig%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787840234&P2=404&P3=2&P4=ESjha9JcVdh4qwD1EZCKOLej8m7z7I7aty%2bdcboiXPTrLorciT0PhtixQK5PgmdJ8nGzr2kEFM5xmZL%2b55GLcg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
23.40.52.111
23.11.37.157

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\1563742a21c2ae2170e00566d76aac30.png - 8733c67afc1f8412e9443fdc68293cc1c6f65a0f18a66a44a7fb4f419af9460a
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 3f01b299fc05381e61d907234e871a29293e6deb1d3ce04524e47248bfaefba1
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://huntic.ru/uplcv?utm_term=clinical+microbiology+textbook+pdf
https://gpuhub.net/wp-content/plugins/super-forms/uploads/php/files/c0e4ffr8kvs7d5adf0vrbjsp63/63386272285.pdf
https://ceramicasvillaflor.cl/UserFiles/File/wemugazomariw.pdf
http://eca.or.th/ckfinder/userfiles/files/zisimomowiza.pdf
http://capri.lt/userfiles/files/43364945272.pdf
http://hosungtour.com/FileData/ckfinder/files/20210925_D423D69CAB7C8D62.pdf
http://danceaction.be/userfiles/file/zegivit.pdf
http://tomasmrazek.cz/userfiles/file/sawavikal.pdf
https://damiel.eu/userfiles/file/jexogagelote.pdf
https://altinhediyeler.com/calisma2/files/uploads/52861305913.pdf
http://zeshengtecphar.com/UploadFiles/FCKeditor/20210922181703.pdf
https://bluetact.com/locktactyuma/userfiles/file/35782704876.pdf
http://walosports.cl/userfiles/file/kelifupenoro.pdf
https://nicemexico.net/wp-content/plugins/formcraft/file-upload/server/content/files/1614cb88d1b693---56092757856.pdf
https://elmaga.lt/components/com_mijoshop/opencart/image/data/files/669907084.pdf
http://studioaba.net/userfiles/files/nogak.pdf
https://cambodiadriverservice.com/userfiles/file/muvokevabe.pdf
http://huefpdf.org/upload/file/54719648487.pdf
http://swvocal.com/data/se2/file/32009876187.pdf
http://phannhan.vn/files/usersfiles/files/vufifuduvegebisavedejanap.pdf
https://castilloexterior.org/ckfinder/userfiles/files/wusenofuvoxu.pdf
http://colegiosantarosa.com/uploads/imagem/file/vutarevozi.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/

Embedded domains

huntic.ru
gpuhub.net
hosungtour.com
danceaction.be
damiel.eu
altinhediyeler.com
zeshengtecphar.com
bluetact.com
nicemexico.net
studioaba.net
cambodiadriverservice.com
huefpdf.org
swvocal.com
castilloexterior.org
colegiosantarosa.com
www.w3.org
purl.org
ns.adobe.com
ceramicasvillaflor.cl
eca.or.th
capri.lt
tomasmrazek.cz
walosports.cl
elmaga.lt
phannhan.vn

Embedded IP addresses

85.210.193.152
20.42.65.88
52.110.12.37
172.215.188.232
4.230.171.124
20.247.185.124
20.184.175.0
74.178.76.128
52.123.129.14
40.99.134.18
20.165.94.63
74.179.71.159
203.26.79.13
92.223.78.30
4.150.223.97
48.200.63.27

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report