MALICIOUS — a390e998dde8c9282bef571641c4e5b4871fbc0cc94d36eac0477da9c8f6b2d3
MALICIOUS — a390e998dde8c9282bef571641c4e5b4871fbc0cc94d36eac0477da9c8f6b2d3 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
a390e998dde8c9282bef571641c4e5b4871fbc0cc94d36eac0477da9c8f6b2d3 - SHA-1:
6d6e8b48f2d2e9f5c45072d6f9f45295d87191e9 - MD5:
e1e4562bf297d1731c3812c4f87025a5 - ssdeep:
1536:cdhWRlF6pqeHbxSyUYk1a1S8PtZU3RRhEUoWGmVdNVWW6pOu26W4HQzgGIy+8m:ShklFyn7xRptZU3RjEJWGmV3VTu2OHvz - TLSH:
T14B38C0E3216FDD9C3B8BDB03A6AB1469A489E7483132C5D4448CB67CE43C97DBE10560 - Submitted as: a390e998dde8c9282bef571641c4e5b4871fbc0cc94d36eac0477da9c8f6b2d3
- File type: pdf · Size: 81512 bytes
- Verdict: malicious (98/100)
Detections (4 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 7 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: http://mulroyenvironmental.ie/userfiles/file/rogidawadulumifazenozog.pdf - network signal, weight 0.70, confidence 0.80
- Contacted 19 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://kga-am-adlergestell-ev.de/kga/ckfinder/userfiles/files/metuxuzoba.pdf, http://urbanconstructions.org/images/uploadedimages/file/najuxagipebuse.pdf, https://www.hungryalex.com/wp-content/plugins/super-forms/uploads/php/files/mgphchsi047k82pquapp42skds/dofotegusi.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
9673 behavior events · 0 ATT&CK techniques · 3 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- c.pki.goog
- desktop-hsgcbep
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- ntp.ubuntu.com
- 250.255.255.239.in-addr.arpa
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
Dropped files
- C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt -
18f9df8ce11bfee081db31a5468b436286d3c01189e7c285332c69cfa8b3c35c - C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\e228a690ee19bcd1ded1bef6d31e91d3.png -
f3142cf9c27fa3523dd3f91ee5926e4d7be7eaf94866803f324aeb4db88c3ff1 - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/Om9ozkHLxGw/uplcv?utm_term=telecommunication+transmission+media+pdf
- https://kga-am-adlergestell-ev.de/kga/ckfinder/userfiles/files/metuxuzoba.pdf
- http://urbanconstructions.org/images/uploadedimages/file/najuxagipebuse.pdf
- https://www.hungryalex.com/wp-content/plugins/super-forms/uploads/php/files/mgphchsi047k82pquapp42skds/dofotegusi.pdf
- http://mulroyenvironmental.ie/userfiles/file/rogidawadulumifazenozog.pdf
- http://baharemadinah.com/wp-content/plugins/formcraft/file-upload/server/content/files/160794a2025ebb---93454595281.pdf
- https://flyags.com/editorResources/file///nularolugisewabod.pdf
- https://areshin.ru/wp-content/plugins/super-forms/uploads/php/files/e63b8b3f0b08320ad05892c7885ce39d/benepoguw.pdf
- http://english-island.pl/wp-content/plugins/super-forms/uploads/php/files/4roj0djdiusch65e7vetq01ec4/16853251529.pdf
- http://www.realisthotel.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a622cb76fec---93545995703.pdf
- http://ciskmv.com/css/file/fulitiledipodenuwovejuli.pdf
- http://assushop.com/userfiles/assushop.com/file/1794511877.pdf
- https://jagamimpi.com/contents//files/keviroditufizuzanugawam.pdf
- https://daaeportrett.no/upload/file/zumidokef.pdf
- https://prolocolidodisavio.org/ckfinder/userfiles/files/76875614999.pdf
- https://autosofortkauf.ch/wp-content/plugins/super-forms/uploads/php/files/fea6eja09a7tfen0gm33oqep4l/dudabikefekakadixiti.pdf
- http://cherriestattoo.com/ckfinder/userfiles/files/jovawopulaniralakil.pdf
- https://www.sharpeningfactory.com/wp-content/plugins/formcraft/file-upload/server/content/files/160904c0bce403---bibebemozakukatirexer.pdf
- http://www.realisthotel.com/wp-content/plugins/formcraft/file-upload/server/content/files/160aa566a09489---zazomawafored.pdf
- http://nofatrans-int.com/userfiles/file/baxetoj.pdf
- http://eduomania.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083a0bddfc6c---38647915343.pdf
- http://tabouligrill.com/ckfinder/userfiles/files/36639702383.pdf
- http://to-kajihan.net/js/upload/files/depujisiw.pdf
- http://aksaaydinlatma.com/img/editor/image/file/vitaposejizuwovibozi.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- feedproxy.google.com
- kga-am-adlergestell-ev.de
- urbanconstructions.org
- www.hungryalex.com
- baharemadinah.com
- flyags.com
- areshin.ru
- english-island.pl
- www.realisthotel.com
- ciskmv.com
- assushop.com
- jagamimpi.com
- daaeportrett.no
- prolocolidodisavio.org
- autosofortkauf.ch
- cherriestattoo.com
- www.sharpeningfactory.com
- nofatrans-int.com
- eduomania.com
- tabouligrill.com
- to-kajihan.net
- aksaaydinlatma.com
- www.w3.org
- purl.org
- ns.adobe.com
Embedded IP addresses
- 52.123.252.224
- 52.123.252.231
- 135.232.92.137
- 13.89.179.15
- 85.210.196.11
- 52.110.12.55
- 20.247.184.197
- 72.154.7.105
- 4.230.171.124
- 203.26.79.13
- 52.123.128.14
- 52.123.252.225
- 52.123.252.212
- 74.179.71.159
- 20.42.179.192
- 74.178.240.61
- 20.42.73.26
- 20.42.65.89
- 4.150.223.100
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report