MALICIOUS — a0f8640b4adee2cfc7a9c378a3cb0f2bf33c3bf1543b23653413993141b67f1a

MALICIOUS — a0f8640b4adee2cfc7a9c378a3cb0f2bf33c3bf1543b23653413993141b67f1a is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: a0f8640b4adee2cfc7a9c378a3cb0f2bf33c3bf1543b23653413993141b67f1a
SHA-1: bdf0ef1dcc890856b651edc2e5205e5df37336be
MD5: 2d540dfc2e794cf9f50369ad76aed03f
ssdeep: 1536:Zj4lh0F14iXtKPHyLIiSFlcu0fD9holbor6zkWxAeF1Ew1W8pO+qmc:ilh0n4idKAIiSFlcu07MCr6zl3rHE+O
TLSH: T16539CFF36157DC5C3BC98F03AAE6166CB085E7886261DA10048CBAADD57C4BCFF60661
Submitted as: a0f8640b4adee2cfc7a9c378a3cb0f2bf33c3bf1543b23653413993141b67f1a
File type: pdf · Size: 92112 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 22 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://lsmtrontractor.com/upfiles/file/20210930195949.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: http://pmke.cz/pictures/files/35941573702.pdf, http://lsmtrontractor.com/upfiles/file/20210930195949.pdf, https://mbbs.hr/files/69521537307.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9814 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787821277&P2=404&P3=2&P4=I20g%2ftob%2bcEJ3ZvWx2kl6JDtR63UH4Q%2bzoVlziEPMqtrxow8QDD0K46cjeI21oNF%2b3Qb%2ffpekHzaGFeqBnhuZQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787821319&P2=404&P3=2&P4=OkfxKbCvHvUb2MXiNQEbb9UAupfUJI0HBHD09lZII2kONCC%2fz%2fBWE3bU40YtsYTxpsUfKoK3w1nz7BBFg0Hzgg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\84f61035c9cae137c2610981550a9177.png - 34d87666784c77c772b8061791e958b6cda1966776b4873bbccac9ac0d3eeaab
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - ecaf986d1423f262315e9c936e9e9a46b3d60ecd1bac398736b3d9f1026b3c87
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Gsjc/~3/RC0zOYPQW8A/uplcv?utm_term=enthalpy+of+combustion+of+glucose
http://pmke.cz/pictures/files/35941573702.pdf
http://lsmtrontractor.com/upfiles/file/20210930195949.pdf
https://mbbs.hr/files/69521537307.pdf
http://euro-ex.com/images/blog/file/57718704931.pdf
https://valleyrentals.com/userfiles/file/xofiwufopuxurulesubedi.pdf
https://velvetskin.pl/wp-content/plugins/super-forms/uploads/php/files/89695a9d1248d9eb709009b7de8e2388/38886770086.pdf
https://bgg.pirkitpadangas.lt/ckfinder/userfiles/files/bekabas.pdf
http://www.belladermeestetica.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1613e568f64375---vifejilijitevapuzoloxa.pdf
https://pet-fashion.ro/mm/file/24062732784.pdf
https://pgp-puh.hr/fck_media/file/9492781114.pdf
https://mitrasuksesku.com/userfiles/file/jajawi.pdf
https://elesud.it/img_pagine/file/47732894269.pdf
http://queuemanagementsystems.com/wp-content/plugins/formcraft/file-upload/server/content/files/16160991c9e6ae---saxerekimarewefeporakuku.pdf
https://wtmasonry.com/ckfinder/userfiles/files/manitiwofokibixorexogas.pdf
https://beautifulhairstore.com/upload/files/tumal.pdf
http://benjapakee.net/UserFiles/File/detegiwonotopijizez.pdf
https://israelonthehouse.com/wp-content/plugins/formcraft/file-upload/server/content/files/16149ddfe8dd07---86176200533.pdf
http://rioairporttransfer.com/ckfinder/userfiles/files/nudeperanaz.pdf
http://smalternatywa.pl/media/upload/files/b830ac2d93dc00c6bb3d97f5fa878065.pdf
https://noble-program.site/js/ckfinder/userfiles/files/15202220567.pdf
http://kocavietnam.com/upload/files/27053470002.pdf
https://weilmclainboiler.ca/fck_upload/file/96747792584.pdf
http://suamayphotocopy.net/userfiles/file/lememuv.pdf
http://kamnitikamini.si/upload/files/kutegopifiwawew.pdf

Embedded domains

feedproxy.google.com
lsmtrontractor.com
euro-ex.com
valleyrentals.com
velvetskin.pl
www.belladermeestetica.com.br
mitrasuksesku.com
elesud.it
queuemanagementsystems.com
wtmasonry.com
beautifulhairstore.com
benjapakee.net
israelonthehouse.com
rioairporttransfer.com
smalternatywa.pl
noble-program.site
kocavietnam.com
weilmclainboiler.ca
suamayphotocopy.net
www.sunarsurdurulebilir.com
faizleathergloves.com
www.w3.org
purl.org
ns.adobe.com
pmke.cz

Embedded IP addresses

20.165.94.46
85.210.193.152
172.66.2.5
52.123.252.195
52.110.12.44
4.230.171.124
20.247.184.142
74.179.77.164
74.179.77.204
20.89.1.9
52.123.128.14
40.103.64.226
72.145.35.100
203.26.79.13
135.234.160.246
52.123.252.226
92.223.78.30
135.234.160.244
172.175.111.170
52.182.141.63
20.184.175.18
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report