MALICIOUS — a4c5d8dee2d4b93ec3d2980ac23da2fb66878281f38d7328b64b40d4df32835c

MALICIOUS — a4c5d8dee2d4b93ec3d2980ac23da2fb66878281f38d7328b64b40d4df32835c is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: a4c5d8dee2d4b93ec3d2980ac23da2fb66878281f38d7328b64b40d4df32835c
SHA-1: cd311994e94edec483ec11e90e5c8fdcd5e99695
MD5: d5b2b2dc4a9280644288700f010ab180
ssdeep: 1536:K0eVtZy37gPtNL0sfU/V0nEqiNYTVXpZkNLn4mLQiDhiOP2iFiL:Ms37gPtx0s6V0jLwtEG4
TLSH: T10937DFF351DBDE5DAA965B577EFA1125A489CB8CB136D7502088BB1CC8BC29C3E11900
Submitted as: a4c5d8dee2d4b93ec3d2980ac23da2fb66878281f38d7328b64b40d4df32835c
File type: pdf · Size: 73846 bytes
Verdict: malicious (84/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!D5B2B2DC4A92
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 84/100 is the fusion of 6 weighted signals:

Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4475204/normal_5fe498d09ae46.pdf - network signal, weight 0.70, confidence 0.80
Contacted 13 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://philabc.ru/pbw?utm_term=griffiths+electromagnetic+theory, https://static.s123-cdn-static.com/uploads/4475204/normal_5fe498d09ae46.pdf, https://cdn-cms.f-static.net/uploads/4407747/normal_605c9d6275b78.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (15 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9709 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787832061&P2=404&P3=2&P4=BsZSf442u32ntchkBafUGzdZKGrreZKia3qMbXw2PK4hgKxDLdaWQELX564mQL8zpY8GxrQzSUn5O3g3KDoVGw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787832134&P2=404&P3=2&P4=DaIv3fwSBewI6uM0Kl%2b5GcqsingV5nhc8lrPVCCsfXczicFKIL446dpnNLZSywCxYsrOANfkSgTXFrPLdprtSQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 28eb6967db5cf6d5a0758988f28bdd4f3cb6d2cc468bb63e95320ace97ab1d4e
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\6d5f0ea74318530f802577bac6fe2331.png - b0e698d3ef80894d249229a82fdb77aff915c3fff5c7dc330c9b10bb904aab32
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://philabc.ru/pbw?utm_term=griffiths+electromagnetic+theory
https://static.s123-cdn-static.com/uploads/4475204/normal_5fe498d09ae46.pdf
https://cdn-cms.f-static.net/uploads/4407747/normal_605c9d6275b78.pdf
http://natofuke.pbworks.com/w/file/fetch/144585870/ap_polytechnic_lecturer_exam_paper.pdf
http://tagexoba.pbworks.com/w/file/fetch/144422319/3899302553.pdf
https://cdn-cms.f-static.net/uploads/4407729/normal_5fd1128c0d5ec.pdf
https://static.s123-cdn-static.com/uploads/4450259/normal_60053888e1122.pdf
https://nanuvofekoredam.weebly.com/uploads/1/3/5/3/135385966/veseputonavisa.pdf
https://static.s123-cdn-static.com/uploads/4408583/normal_6006e59fc69f5.pdf
https://lekakuvikel.weebly.com/uploads/1/3/1/3/131380005/3317613.pdf
https://static.s123-cdn-static.com/uploads/4420039/normal_5ff84852c9d4d.pdf
https://badipixurer.weebly.com/uploads/1/3/4/4/134456466/debag_palalep_nuwiriti.pdf
https://cdn-cms.f-static.net/uploads/4481403/normal_60bd42626d438.pdf
https://cdn-cms.f-static.net/uploads/4481994/normal_60318225e06ae.pdf
https://cdn-cms.f-static.net/uploads/4452400/normal_60403b2557928.pdf
https://fizabogozof.weebly.com/uploads/1/3/2/8/132815807/3978702.pdf
https://cdn-cms.f-static.net/uploads/4388825/normal_60be9299135dd.pdf
https://cdn-cms.f-static.net/uploads/4453334/normal_6069980494e01.pdf
https://cdn-cms.f-static.net/uploads/4416675/normal_601de96788a3b.pdf
https://xinejusitap.weebly.com/uploads/1/3/4/6/134630468/powovixenope.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/

Embedded domains

philabc.ru
static.s123-cdn-static.com
cdn-cms.f-static.net
natofuke.pbworks.com
tagexoba.pbworks.com
nanuvofekoredam.weebly.com
lekakuvikel.weebly.com
badipixurer.weebly.com
fizabogozof.weebly.com
xinejusitap.weebly.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

4.150.223.109
52.110.12.3
4.230.171.124
57.154.63.210
20.184.175.6
74.179.77.204
20.231.239.246
40.103.64.226
203.26.79.13
52.123.129.14
74.179.71.159
4.150.223.108
4.150.223.97

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report