MALICIOUS — ab56369c7a816fa66c4edc1aa10b6d1c4182eca41e9b1d4c08d22b589e9c5117

MALICIOUS — ab56369c7a816fa66c4edc1aa10b6d1c4182eca41e9b1d4c08d22b589e9c5117 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 54 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: ab56369c7a816fa66c4edc1aa10b6d1c4182eca41e9b1d4c08d22b589e9c5117
SHA-1: d10e19f344d564786e05c584b089cb45bc2b5b19
MD5: b75bc6787460058b6ab86e6f329c9d87
ssdeep: 1536:KdpQcAZNbEWbk1Wa9+aEa4YIWw6xxWPlg9EVWwpOSsGT:spQcUNbNk1Wa9+aEvYgo+v8SV
TLSH: T1C537C0F3229BDE8C76575F4369EB019CE58ED24C2162EB514188BABCA17C97CBF04940
Submitted as: ab56369c7a816fa66c4edc1aa10b6d1c4182eca41e9b1d4c08d22b589e9c5117
File type: pdf · Size: 70948 bytes
Verdict: malicious (99/100)

Detections (4 of 54 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://wakingbeauty.com/wp-content/plugins/formcraft/file-upload/server/content/files/161475f7601122---zuvokijawe.pdf - network signal, weight 0.70, confidence 0.80
Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://medvor.ru/uplcv?utm_term=2+letter+r+words, http://artgraf24.pl/userfiles/file/sisejapuvitutusuzis.pdf, https://unitytradefze.com/ckfinder/userfiles/files/50813162834.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Contacted 10 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

1006 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
desktop-hsgcbep._dosvc._tcp.local
desktop-hsgcbep(1)._dosvc._tcp.local
desktop-hsgcbep(2)._dosvc._tcp.local
desktop-hsgcbep(3)._dosvc._tcp.local
desktop-hsgcbep(4)._dosvc._tcp.local
desktop-hsgcbep(5)._dosvc._tcp.local
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
23.40.52.85
162.159.142.9 US · San Francisco · AS13335 Cloudflare, Inc.
23.11.37.157
20.190.142.166
4.144.132.114 SG · Singapore · AS8075 Microsoft Corporation
52.123.252.223 AU · Sydney · AS8075 Microsoft Corporation

Dropped files

root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://medvor.ru/uplcv?utm_term=2+letter+r+words
http://artgraf24.pl/userfiles/file/sisejapuvitutusuzis.pdf
https://unitytradefze.com/ckfinder/userfiles/files/50813162834.pdf
http://vpecargo.com/userfiles/file/14235334707.pdf
http://wsm.hk/images/uploadfiles/file/dugutozok.pdf
http://leeharringtonhomes.com/userfiles/file/57044460817.pdf
https://aryaayur.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613460fd466a2---60007646209.pdf
http://pune-india.info/userfiles/file/xisag.pdf
http://pavcargo.ru/wp-content/plugins/super-forms/uploads/php/files/5485e0ba03dbbcef4cd73667f9aad011/dizopogijaniresuzutak.pdf
http://wakingbeauty.com/wp-content/plugins/formcraft/file-upload/server/content/files/161475f7601122---zuvokijawe.pdf
https://used-machinetools.ro/app/webroot/files/userfiles/files/totewabaletiboruxajilopop.pdf
http://oilmachineydy.com/d/files/tuxexusivirilixutuweno.pdf
https://oasis-travel.ro/files/39825768005.pdf
https://auf.vn/wp-content/plugins/super-forms/uploads/php/files/p41qds10ep6ivagg2aoiqigdm2/wamesitaxozozu.pdf
https://idealist.ro/userfiles/file/venodefamud.pdf
http://kukdae.com/files/fckeditor/file/3745571964.pdf
https://am-system.eu/ckfinder/userfiles/files/kuvatuzanivejuzi.pdf
https://popa.com.br/wp-content/plugins/super-forms/uploads/php/files/6eb6eae5a4296cf01b0f3778fababb07/59197936917.pdf
http://seksdagen.nl/userfiles/file/32612646792.pdf
http://www.eflox.net/wp-content/plugins/formcraft/file-upload/server/content/files/161483198e3dad---9848284005.pdf
http://netcentricnj.com/ckfinder/userfiles/files/wagewifosixazi.pdf
http://sklenicky-obchod.cz/web/admin/fckeditor/userfiles/file/76979529006.pdf
http://33podarka.ru/pictures/files/dewobotatisugi.pdf
https://turismopontevedra.com/ckfinder/userfiles/files/gabagezobigidibix.pdf
http://redactron.com/userfiles/file/fevorofakabipunor.pdf

Embedded domains

medvor.ru
artgraf24.pl
unitytradefze.com
vpecargo.com
wsm.hk
leeharringtonhomes.com
aryaayur.com
pune-india.info
pavcargo.ru
wakingbeauty.com
oilmachineydy.com
kukdae.com
am-system.eu
popa.com.br
seksdagen.nl
www.eflox.net
netcentricnj.com
33podarka.ru
turismopontevedra.com
redactron.com
www.ijestr.com
academiesutherland.com
drivingschoolofnorthtexas.com
www.w3.org
purl.org

Embedded IP addresses

72.145.35.97
4.150.223.97
72.145.35.96
162.159.142.9
4.144.132.114
52.123.252.223
4.230.171.124
4.150.223.107
57.155.104.224
72.145.35.109

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report