MALICIOUS — a589be68ae5d8c530b59a895b7d8b5eb191ace67d8233ffb486007ca384df2a3
MALICIOUS — a589be68ae5d8c530b59a895b7d8b5eb191ace67d8233ffb486007ca384df2a3 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
a589be68ae5d8c530b59a895b7d8b5eb191ace67d8233ffb486007ca384df2a3 - SHA-1:
3f058be47ac6abcde15e29f77f4b6cd21db2bca1 - MD5:
e06659d6f73e86fa7b3ac1da322b10a5 - ssdeep:
12288:fUBALT5FXeXrCOLAvdkumMyqphgDjii5Nba3ik0bbbeG9eGYWY:xHUeO8Vk97qvuX2kbbbeGCX - TLSH:
T1BD4D12F7614BCD8D774BD303B5AB0018294A93A97522D7C5848D7B6C8ABC47DAC60AF0 - Submitted as: a589be68ae5d8c530b59a895b7d8b5eb191ace67d8233ffb486007ca384df2a3
- File type: pdf · Size: 581725 bytes
- Verdict: malicious (98/100)
Detections (4 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 7 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: https://uploads.strikinglycdn.com/files/8f84dc51-f08f-4378-8dc1-95fea05e1d3a/9751770757.pdf - network signal, weight 0.70, confidence 0.80
- Contacted 18 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://crophysi.ru/strik?utm_term=how+to+turn+on+sunbeam+heated+blanket, https://xexonuza.weebly.com/uploads/1/3/4/3/134305788/454f009f4a97cc9.pdf, https://moninedowilex.weebly.com/uploads/1/3/1/4/131436981/1390092.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Extracted generic config (8 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
10023 behavior events · 0 ATT&CK techniques · 3 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- desktop-hsgcbep
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- ntp.ubuntu.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
Dropped files
- C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt -
f6e0190ce4e128eb66ced00b62afaf08a9861c5cdfc9b1dfedadcf3002a61abb - C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\8cb9fd52c803b41cdc7ea49b56d63095.png -
d47abf94b0aebc89e9397c46b9973d58ea594d9f06ab9b89a29e3419b9c6968a - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://crophysi.ru/strik?utm_term=how+to+turn+on+sunbeam+heated+blanket
- https://xexonuza.weebly.com/uploads/1/3/4/3/134305788/454f009f4a97cc9.pdf
- https://moninedowilex.weebly.com/uploads/1/3/1/4/131436981/1390092.pdf
- https://vobasonuniba.weebly.com/uploads/1/3/4/6/134668907/jukurawasotiref.pdf
- https://s3.amazonaws.com/sobaketemu/linksys_wrt160n_v2_firmware_upgrade_download.pdf
- https://lurusinobafor.weebly.com/uploads/1/3/2/7/132710654/8425d.pdf
- https://uploads.strikinglycdn.com/files/8f84dc51-f08f-4378-8dc1-95fea05e1d3a/9751770757.pdf
- https://genebametujo.weebly.com/uploads/1/3/4/9/134904617/dca1a406f1b01.pdf
- https://vifoxofanope.weebly.com/uploads/1/3/4/6/134670603/nilewaxuwebezizanado.pdf
- https://uploads.strikinglycdn.com/files/29bdbe65-f13e-43f3-8ca5-03e113e0fdeb/fezugakoleka.pdf
- https://ginadilu.weebly.com/uploads/1/3/4/7/134768391/silifepej_nafunuzabowi_gigig.pdf
- https://cdn-cms.f-static.net/uploads/4401697/normal_606ddbdba7bc3.pdf
- https://nubonikajifubi.weebly.com/uploads/1/3/4/8/134882340/ed9e20a0b35.pdf
- https://cdn-cms.f-static.net/uploads/4368468/normal_606e5f9e6f493.pdf
- https://uploads.strikinglycdn.com/files/e75b4132-99af-4ad6-a61d-6a98215fde1c/how_to_crack_minecraft_2020.pdf
- https://rezezeveg.weebly.com/uploads/1/3/1/8/131871466/gifabowoneled-roxubemab.pdf
- https://s3.amazonaws.com/vatakefojunib/lutuzavimimagopemutefunod.pdf
- https://cdn-cms.f-static.net/uploads/4447885/normal_602b5fefa41ba.pdf
- https://s3.amazonaws.com/gaxuremewuger/astrid_s_songs_free.pdf
- https://cdn-cms.f-static.net/uploads/4383795/normal_60442f3145cee.pdf
- https://s3.amazonaws.com/mudurixo/hearthstone_boomsday_project_solo_adventure_guide.pdf
- https://uploads.strikinglycdn.com/files/ab4d2fbd-d311-4764-b139-e82ed6172854/9055737952.pdf
- https://zudovizu.weebly.com/uploads/1/3/4/3/134338339/tofitit-lowis-ziwiniwenaxube-dojutugez.pdf
- https://cdn-cms.f-static.net/uploads/4476943/normal_600ddb0b056b6.pdf
- https://s3.amazonaws.com/tufujifinobiro/37585869468.pdf
Embedded domains
- crophysi.ru
- sj.za
- xexonuza.weebly.com
- moninedowilex.weebly.com
- vobasonuniba.weebly.com
- s3.amazonaws.com
- lurusinobafor.weebly.com
- uploads.strikinglycdn.com
- genebametujo.weebly.com
- vifoxofanope.weebly.com
- ginadilu.weebly.com
- cdn-cms.f-static.net
- nubonikajifubi.weebly.com
- rezezeveg.weebly.com
- zudovizu.weebly.com
- lulotabo.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Embedded IP addresses
- 48.211.4.16
- 52.123.252.239
- 52.110.12.38
- 4.230.171.124
- 172.215.188.225
- 52.123.252.226
- 72.145.35.97
- 203.26.79.13
- 20.184.175.2
- 20.76.201.171
- 74.179.77.204
- 52.123.129.14
- 40.103.64.242
- 135.234.160.245
- 92.223.78.30
- 172.170.180.133
- 4.150.223.102
- 20.42.73.25
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report