MALICIOUS — bifalorogifijaj.pdf

MALICIOUS — bifalorogifijaj.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 5 of 50 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: a61aa4b664d432646130b7d2903b0b8c93afbc2eaf861c38b0dd9ead6f874225
SHA-1: 485367d9698a13dac5adc71226ee91b40f20f23a
MD5: 464da5fd8b13f5d07381e4487fb44022
ssdeep: 1536:2U4XcxObngw3ssuRy3LTkdkHjuX73gHm2onEA6:9YngAssu033kiDuXzGmHn2
TLSH: T17537D0F3619BDD4C795FAB137EE664681859C2896037E680044CB73CD9BCBBE2D10A50
Submitted as: bifalorogifijaj.pdf
File type: pdf · Size: 72467 bytes
Verdict: malicious (99/100)

Detections (5 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!464DA5FD8B13

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Lazarus): root_.cache_dconf_user - dynamic signal, weight 0.80, confidence 0.90
Contacted 37 external host(s) at runtime (7 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://www.optionassurance.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160845fb68a219---fifipimab.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: http://workprohealth.com/wp-content/plugins/formcraft/file-upload/server/content/files/160796059ba7d3---fumovexuwuremon.pdf, http://countrysquirefoods.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083a65c280ae---naletotupazusavubatarobij.pdf, http://www.northeastmarquees.com/wp-content/plugins/super-forms/uploads/php/files/5169c5d5705ccd57a743e969f4ba0542/88600874918.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9686 behavior events · 1 ATT&CK techniques · 4 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
ntp.ubuntu.com
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

/opt/CAPEv2/storage/analyses/18711/files/c04ec13844a0d274e260e2198c3274fa9347c11b4a58600eeee927052982c707 - c04ec13844a0d274e260e2198c3274fa9347c11b4a58600eeee927052982c707
/opt/CAPEv2/storage/analyses/18711/files/2af7a74dcc28f27d519eb10178905f4e60564d3186ec73676a44913e45759eb7 - 2af7a74dcc28f27d519eb10178905f4e60564d3186ec73676a44913e45759eb7
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
tmp_tmp.80ZNXKehES - a40d55103196c676fa2eb689eb4f582657c1debefc141a51965d79279124bba8

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/ngfLrbzwjls/uplcv?utm_term=fortune+data+sheet
http://workprohealth.com/wp-content/plugins/formcraft/file-upload/server/content/files/160796059ba7d3---fumovexuwuremon.pdf
http://countrysquirefoods.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083a65c280ae---naletotupazusavubatarobij.pdf
http://www.northeastmarquees.com/wp-content/plugins/super-forms/uploads/php/files/5169c5d5705ccd57a743e969f4ba0542/88600874918.pdf
http://www.optionassurance.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160845fb68a219---fifipimab.pdf
http://www.chicagoalphas.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607678db74395---52765532110.pdf
http://pebyte.com/wp-content/plugins/super-forms/uploads/php/files/r62de87anr6topsbsmdqkh8556/toliju.pdf
https://foxtailmag.net/wp-content/plugins/super-forms/uploads/php/files/b985ad8b71a245f40a5e610933fc83e7/nigodizalodarulekizolir.pdf
http://lirealestatelitigator.com/wp-content/plugins/super-forms/uploads/php/files/c4f8630e9b341f6a1de96ce1012cc735/18910572526.pdf
https://asiaviews.org/wp-content/plugins/super-forms/uploads/php/files/09584resgtcmcon7psd8uph162/notusafewabis.pdf
https://shrmivirtual.org/wp-content/plugins/super-forms/uploads/php/files/22cbf264c74893aab551e813e89fbf11/piratipukuwaz.pdf
https://belgradenightlife.info/wp-content/plugins/super-forms/uploads/php/files/u9f2nf2tj6sh8rdpspf5ft219c/jogadedevifibo.pdf
https://cffcommunications.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1/16082fad11c064---xegabogunomamavabo.pdf
https://nationalcardsolutions.com/wp-content/plugins/formcraft/file-upload/server/content/files/16076d1fa7f1c6---40010003972.pdf
https://hoovermaids.com/wp-content/plugins/super-forms/uploads/php/files/0b032dbb913f324c15fc7be45c423447/maverigene.pdf
http://adanateknikservis.web.tr/wp-content/plugins/formcraft/file-upload/server/content/files/1607fd47def09d---58606499323.pdf
http://www.canadavisaservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/160786020acff1---mexovibuluzozamunedexudi.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Embedded domains

feedproxy.google.com
workprohealth.com
countrysquirefoods.com
www.northeastmarquees.com
www.optionassurance.ca
www.chicagoalphas.com
pebyte.com
foxtailmag.net
lirealestatelitigator.com
asiaviews.org
shrmivirtual.org
belgradenightlife.info
cffcommunications.nl
nationalcardsolutions.com
hoovermaids.com
www.canadavisaservices.com
www.w3.org
purl.org
ns.adobe.com
adanateknikservis.web.tr

Embedded IP addresses

172.215.188.225
20.42.179.204
4.150.223.111
52.110.12.55
4.230.171.124
40.84.85.40
20.165.94.63
20.184.175.5
72.145.35.99
74.178.76.54
203.26.79.13
52.123.128.14
92.223.78.30
20.184.175.17
4.150.223.97

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report