MALICIOUS — a7a68cb4211b156a9289b3b276317b49aab945367ff2a218f422d8a7821da785

MALICIOUS — a7a68cb4211b156a9289b3b276317b49aab945367ff2a218f422d8a7821da785 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: a7a68cb4211b156a9289b3b276317b49aab945367ff2a218f422d8a7821da785
SHA-1: 8dfdb0657c53751fc43b1f7104f0e8a0838b7d43
MD5: a757bbfc84710e0308e260f1540c95f7
ssdeep: 1536:xgX4DPwJkSYXS9xxdYd4yptxzIczARD1mlpZOoq1j0QzbwkKKICWapOtQHWZ88B6:aoaYXSX6LpHzIHDJog3wbKIftQCfJUD
TLSH: T1C33AD0F3209BDD8C7757AF03BAA951AC6446E3882173EF61408C796C947CABD6F10852
Submitted as: a7a68cb4211b156a9289b3b276317b49aab945367ff2a218f422d8a7821da785
File type: pdf · Size: 95433 bytes
Verdict: malicious (99/100)

Detections (4 of 54 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 7 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://irlanc.ru/uplcv?utm_term=crossfire+philippines+manual+patch+december+4+2018, http://www.cascinasorigherio.it/wp-content/plugins/formcraft/file-upload/server/content/files/160bbba1c75e72---gikadadabigojir.pdf, https://alatheir.com/atheirwsfiles/file/85321182550.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 4 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in Acrobat.exe (pid 3348) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

1127 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
c.pki.goog
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
250.255.255.239.in-addr.arpa
WORKGROUP
ntp.ubuntu.com
desktop-hsgcbep._dosvc._tcp.local
desktop-hsgcbep(1)._dosvc._tcp.local
desktop-hsgcbep(2)._dosvc._tcp.local
desktop-hsgcbep(3)._dosvc._tcp.local
desktop-hsgcbep(4)._dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl

Dropped files

root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://irlanc.ru/uplcv?utm_term=crossfire+philippines+manual+patch+december+4+2018
http://www.cascinasorigherio.it/wp-content/plugins/formcraft/file-upload/server/content/files/160bbba1c75e72---gikadadabigojir.pdf
https://alatheir.com/atheirwsfiles/file/85321182550.pdf
http://hanarotalk.com/userfiles/file///pisalitazamofetobudoz.pdf
http://0048.pl/48files/file/zomesawabebikageroxo.pdf
http://gayaarchi.com/userfiles/file/20210819112334.pdf
http://sshs1962.info/clients/3/33/33dcd814b32da85629335a95ab3d0158/File/remerajefasifer.pdf
http://kirsanov-maslo.ru/uploads/gevewu.pdf
https://studiogreenwich.ru/wp-content/plugins/super-forms/uploads/php/files/5d7aa8d62e334ed0fbe6153266b4504d/46824489073.pdf
http://teranor.com/ckfinder/userfiles/files/51059592701.pdf
https://tlpnw.com/wp-content/plugins/super-forms/uploads/php/files/b6b51253319f5a21e3c5450f878bb306/49376499015.pdf
http://ifa-astrologie.de/userfiles/file/juwumamerusezori.pdf
http://primaneighbors.com/userimages/jirit.pdf
https://leo-translate.com.ua/wp-content/plugins/formcraft/file-upload/server/content/files/16085291439d8c---45276533364.pdf
https://bodymart.in/ckfinder/userfiles/files/lozunamemabamem.pdf
https://realimpacto.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160b64b78ce5b6---61408737658.pdf
http://magogaralbamoble.com/galeria/files/vibewurezimazavumijuzesog.pdf
http://amoy-art.com/Upload/file/xumun.pdf
http://www.bestlifepolicy.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/16130df6e3616b---fomevaririfejo.pdf
http://garmagostaran.com/Upload/file/1022707962.pdf
https://www.fifatravels.com/wp-content/plugins/formcraft/file-upload/server/content/files/160821d984f89f---pavagavuwuzexudoporuxozom.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/

Embedded domains

irlanc.ru
www.cascinasorigherio.it
alatheir.com
hanarotalk.com
0048.pl
gayaarchi.com
sshs1962.info
kirsanov-maslo.ru
studiogreenwich.ru
teranor.com
tlpnw.com
ifa-astrologie.de
primaneighbors.com
leo-translate.com.ua
bodymart.in
realimpacto.com.br
magogaralbamoble.com
amoy-art.com
www.bestlifepolicy.co.uk
garmagostaran.com
www.fifatravels.com
www.w3.org
purl.org
ns.adobe.com
x2.c.lencr.org

Embedded IP addresses

52.148.114.188
162.159.142.9
52.230.59.222
52.110.12.15
4.230.171.124
48.211.4.16
52.168.117.169

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report