MALICIOUS — a74333b4935e5fe90a28f47d6d975ab29184f163580f4fa5ad2d2ac2a1f5aab9

MALICIOUS — a74333b4935e5fe90a28f47d6d975ab29184f163580f4fa5ad2d2ac2a1f5aab9 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: a74333b4935e5fe90a28f47d6d975ab29184f163580f4fa5ad2d2ac2a1f5aab9
SHA-1: 61b1c8cc3ee5b4c5711ac41f9c0bef9fe44130c8
MD5: 7ce4bb5a07354cb1fe0590991e1857a3
ssdeep: 1536:5Ry39ksTnahYa9InfTQSa2x/Itq8pxJWUpO7qWms8D+ToT2:/yNk+aCa9I0cIA2xs7Qs8D+TR
TLSH: T1FB37CFF3119BED4C77879F07BDEB1268A44AD7881132DB509484776CC2BC9ADBB10A12
Submitted as: a74333b4935e5fe90a28f47d6d975ab29184f163580f4fa5ad2d2ac2a1f5aab9
File type: pdf · Size: 72845 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Contacted 17 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://twinslock.com/locktactyuma/userfiles/file/zolegakevuvifuw.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://synerhu.ru/uplcv?utm_term=warner+company%27s+year+end+unadjusted+trial+balance+shows+accounts+receivable, http://coomargroup.com/ckfinder/userfiles/files/26848193595.pdf, https://bloomlight.pl/_bloom/file/norixire.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9566 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 94c50b79cc7bb838a9c96c3cddfdbf823249bf26db37377c9b6cf7d4ca9707f6
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\0f007ec95cf046c141b2cd8e38645771.png - 9712e003091ab0fe22ca5253a88ecc55201e15063d3fb7a7d5169074eb21b87a
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://synerhu.ru/uplcv?utm_term=warner+company%27s+year+end+unadjusted+trial+balance+shows+accounts+receivable
http://coomargroup.com/ckfinder/userfiles/files/26848193595.pdf
https://bloomlight.pl/_bloom/file/norixire.pdf
https://dollarplus98.com/images/upload/files/63933089727.pdf
http://ballmillfactory.com/d/files/5288017880.pdf
http://neza.cz/UserFiles/File/pozamitesavaje.pdf
https://dpdpunjabi.myskoolapp.com/FCKeditor/FCKimgUpload/file/bupakali.pdf
https://chiataiec.com/userfiles/Proj_Name/files/99327353181.pdf
https://fallahi-sch.com/userfiles/file/45274315316.pdf
https://twinslock.com/locktactyuma/userfiles/file/zolegakevuvifuw.pdf
http://culfordequestriancentre.org/UserFiles/file/dipupusojodiribazu.pdf
https://yuktogel.com/contents/files/88795634256.pdf
http://chinatriage.com/ckfinder/userfiles/files/lojojavix.pdf
http://sambometal.com/dataroom/file/42995813617.pdf
https://cremeconferences.com/wp-content/plugins/super-forms/uploads/php/files/7d9abd3e324340cd9573c4eda4ea0d23/gafigonozipom.pdf
http://mixmarketing.vn/upload/fck/file/39393296088.pdf
https://kidneystonetreatment.in/userfiles/files/lovubepojekevixesago.pdf
https://asiatravel.kg/wp-content/plugins/super-forms/uploads/php/files/35257b002c55674e609b8db513d964c9/42788593498.pdf
https://doina.md/fckeditorfiles/file/38735367394.pdf
https://bosingels.nl/ckfinder/userfiles/files/difitarivubifuruzogix.pdf
https://www.puskinas.lt/ckfinder/userfiles/files/funosiresopujemi.pdf
https://imagebeaute.fr/userfiles/file/99083974303.pdf
http://satcomlink.com/userData/board/file/divefadadeluvimixafe.pdf
http://sarahscupcakery.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614bffbbd3a45---38410974560.pdf
http://secureyun.cn/uploadfile/file///2021092612554773.pdf

Embedded domains

synerhu.ru
coomargroup.com
bloomlight.pl
dollarplus98.com
ballmillfactory.com
dpdpunjabi.myskoolapp.com
chiataiec.com
fallahi-sch.com
twinslock.com
culfordequestriancentre.org
yuktogel.com
chinatriage.com
sambometal.com
cremeconferences.com
kidneystonetreatment.in
bosingels.nl
imagebeaute.fr
satcomlink.com
sarahscupcakery.com
secureyun.cn
sieseam.org
www.w3.org
purl.org
ns.adobe.com
neza.cz

Embedded IP addresses

13.69.109.131
92.223.78.30
52.123.252.227
52.110.12.37
4.230.171.124
57.154.63.210
20.247.184.142
74.178.76.128
74.178.240.51
52.123.129.14
20.42.65.94
20.42.73.27
72.154.7.114
203.26.79.13
4.247.188.233
135.233.95.80
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report