MALICIOUS — a6387c5698188300f7c9e1f1974ead40b80f6adb27c2e05ea7d3f6b2c8e5b809

MALICIOUS — a6387c5698188300f7c9e1f1974ead40b80f6adb27c2e05ea7d3f6b2c8e5b809 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 50 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: a6387c5698188300f7c9e1f1974ead40b80f6adb27c2e05ea7d3f6b2c8e5b809
SHA-1: 823f468cb14b1b0d8c16e51e636cb4ca7a7f8bf1
MD5: 5bd3f7e8125ebe2a1e35e2414211db5b
ssdeep: 1536:mAK7SZy6HmTZuF6RmDNYiUxFoAjcc3n3mTWkNpOPaWqhUue30l8bVEGIMp:1ZynTa668xuocs3mEPGUcl8bug
TLSH: T12138D0F36197CC5C77479B4349AA12ADA04BD3842252FF8080897A6CDAFCDFD6A20D50
Submitted as: a6387c5698188300f7c9e1f1974ead40b80f6adb27c2e05ea7d3f6b2c8e5b809
File type: pdf · Size: 77480 bytes
Verdict: malicious (99/100)

Detections (4 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Lazarus): root_.cache_dconf_user - dynamic signal, weight 0.80, confidence 0.90
Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Embedded link rated suspicious by URL analysis: http://rtm-plus.com/ckfinder/userfiles/files/26254053702.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://www.entornopublicitario.com/wp-content/plugins/super-forms/uploads/php/files/e73ee1ea16c82d68c5ff3226f188074a/likilesupezagugavaniduras.pdf, http://www.tokyomagic.jp/images/library/File/69288881157.pdf, http://deborahkay.com/ckfinder/userfiles/files/werilivupomimomowukod.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Contacted 5 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

1037 behavior events · 0 ATT&CK techniques · 2 dropped files.

Runtime network

desktop-hsgcbep
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
ff02::1:3
224.0.0.252
169.254.255.255
40.126.14.164
10.240.0.255
10.240.0.1
224.0.0.251
ff02::fb
224.0.0.22
255.255.255.255
ff02::16
ff02::1:ff12:3456
ff02::1

Dropped files

root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
tmp_tmp.1fzgyDY3ZV - 4b3491629382737aff2eb4cdbcce5daeae51bc5697f891c728d3ce21bde072c1

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/DOqCt-cVA4I/uplcv?utm_term=john+wick+2014+streaming+vf
https://www.entornopublicitario.com/wp-content/plugins/super-forms/uploads/php/files/e73ee1ea16c82d68c5ff3226f188074a/likilesupezagugavaniduras.pdf
http://www.tokyomagic.jp/images/library/File/69288881157.pdf
http://deborahkay.com/ckfinder/userfiles/files/werilivupomimomowukod.pdf
http://rtm-plus.com/ckfinder/userfiles/files/26254053702.pdf
https://postelezmasivu-praha.cz/ckfinder/userfiles/files/2707949860.pdf
http://www.christinemartin.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1612ff8ab7f30c---bexopogobijamedofusa.pdf
http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613abc2769bc4---wobudowaxipetojogupekuf.pdf
https://k-barrierfree.com/FileData/ckfinder/files/20210925_CCC50FBA853DC7DC.pdf
https://www.havanasalsa-dance-tours.com/wp-content/plugins/super-forms/uploads/php/files/4272b8146719a04c58730e19bd5f717d/jumojapog.pdf
http://koreanhotpot.com/uploads/files/61983018058.pdf
http://shopcloud.cloud/ckfinder/userfiles/files/717301175.pdf
https://thehouseproduction.net/file/37649710618.pdf
http://ubytovani-budejovice.cz/picture/vtextu/file/94016600619.pdf
https://journeywithmypet.com/ckfinder/userfiles/files/98712615813.pdf
https://irish-setter-zucht.info/ckfinder/userfiles/files/pifejumomunat.pdf
http://mzch.pl/userfiles/file/zafasozeminoruvabizusedu.pdf
http://www.barankayalar.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/16137934eb8473---juvak.pdf
http://birdwatching.sk/media/file/99601543073.pdf
http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614fd8841e38a---jepagolosorebi.pdf
https://lostsoulsmemorialnj.org/wp-content/plugins/super-forms/uploads/php/files/19580ed8b68a33543dedd349a5e89669/vemurepugotava.pdf
http://geredekombiservisi.com/userfiles/file/fimeziloloxototo.pdf
https://edukiya.com/wp-content/plugins/super-forms/uploads/php/files/cc110ae96a1b8249b4e36e59dbe780f9/45974571050.pdf
https://vientangluc.com/upload/files/vuxefirojabisobufodokeja.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

feedproxy.google.com
www.entornopublicitario.com
www.tokyomagic.jp
deborahkay.com
rtm-plus.com
www.christinemartin.co.uk
www.1000ena.com
k-barrierfree.com
www.havanasalsa-dance-tours.com
koreanhotpot.com
shopcloud.cloud
thehouseproduction.net
journeywithmypet.com
irish-setter-zucht.info
mzch.pl
hellnocancershow.com
lostsoulsmemorialnj.org
geredekombiservisi.com
edukiya.com
vientangluc.com
www.w3.org
purl.org
ns.adobe.com
postelezmasivu-praha.cz
ubytovani-budejovice.cz

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report