MALICIOUS — aba006b7c0f24a9506f3da57eebf4deb4a6f221bd1fcecfbde7bedd36cf5599a

MALICIOUS — aba006b7c0f24a9506f3da57eebf4deb4a6f221bd1fcecfbde7bedd36cf5599a is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: aba006b7c0f24a9506f3da57eebf4deb4a6f221bd1fcecfbde7bedd36cf5599a
SHA-1: 98590dededa6b09d7d6e11782759159c21107275
MD5: 0a973478201a599434df408eb197fe64
ssdeep: 1536:ENoCuh9NYhaEsI5iczFh1+GFcubv3vDAqDjWob4f4MpY0WspORWkaC:YoCiEDicDxLbv3vDtD4f4MpYvRWA
TLSH: T1D138D0F761A7DD4C728BDB037AB610689486EA843172EB50408CBA6CC5FC5BDBF14621
Submitted as: aba006b7c0f24a9506f3da57eebf4deb4a6f221bd1fcecfbde7bedd36cf5599a
File type: pdf · Size: 83540 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://westpakusa.com/phpsites/vertical_living/uploads/file/fixuduzewelotemulomuzeki.pdf - network signal, weight 0.70, confidence 0.80
Contacted 19 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://smidgel.ru/uplcv?utm_term=easy+recovery+essentials+bootable+iso+windows+10+free+download, http://westpakusa.com/phpsites/vertical_living/uploads/file/fixuduzewelotemulomuzeki.pdf, https://dom4m.com/userfiles/files/32262640453.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9673 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 8d2f483c89f226dacec5e4e843d2b8e00085f098400f3169edc4d45932f5d469
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\800e498b9cc556310bf74ab0c27b2a52.png - 40a02bcaaad2df3c7158138b3034ce2d120b904ee9f615363a59129fb8670301
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://smidgel.ru/uplcv?utm_term=easy+recovery+essentials+bootable+iso+windows+10+free+download
http://westpakusa.com/phpsites/vertical_living/uploads/file/fixuduzewelotemulomuzeki.pdf
https://dom4m.com/userfiles/files/32262640453.pdf
http://sbcnepal.com/images/file/27118885599.pdf
https://fjordancv.info/wp-content/plugins/super-forms/uploads/php/files/771b96d176026d0ba779c4d78ce5b3ce/luwefozivu.pdf
http://sangjeom.com/userfiles/file///xazutesopujonibadojoli.pdf
http://sportservistocik.cz/UserFiles/File/tekop.pdf
https://varida-tech.com/ckfinder/userfiles/files/bakemabu.pdf
http://weforyou.it/userfiles/files/ravated.pdf
https://peltonfell.org.uk/ckfinder/userfiles/files/joropawefex.pdf
http://vaynhe.com/upload/files/fefevomegitepod.pdf
http://apartmany.cucoriedka.sk/data/files/25258690704.pdf
http://cariboohose.com/userfiles/file/62048087344.pdf
http://uat.ideadunes.com/projects/ideadunes-portfolio-site/wp-content/plugins/formcraft/file-upload/server/content/files/1613e5cd5b84f8---ropixivadixufag.pdf
http://bowie.abwingsmd.com/uploads/files/goraxilegapawalizowixa.pdf
http://ilsungwarehouse.com/userData/ebizro_board/file/96714256801.pdf
http://4chan.ro/UserFiles/file/48400713262.pdf
http://dobre-jaja.com/Upload/file/lawipoximuletisarib.pdf
http://kiuanai.com/userfiles/file/tebonipaxilivu.pdf
https://iamluno.com/wp-content/plugins/formcraft/file-upload/server/content/files/16131d88ed24ac---zorozuzebuluzolavi.pdf
http://tks-forever.com/upload/2021/09/14/file/xifidudefolibomi.pdf
http://hanasushipickup.com/uploads/files/21783084284.pdf
http://ntouioc.ntou.edu.tw/ckfinder/userfiles/files/80067939349.pdf
http://car-zone.sk/data/data/file/72139965494.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

smidgel.ru
westpakusa.com
dom4m.com
sbcnepal.com
fjordancv.info
sangjeom.com
varida-tech.com
weforyou.it
peltonfell.org.uk
vaynhe.com
cariboohose.com
uat.ideadunes.com
bowie.abwingsmd.com
ilsungwarehouse.com
dobre-jaja.com
kiuanai.com
iamluno.com
tks-forever.com
hanasushipickup.com
ntouioc.ntou.edu.tw
www.w3.org
purl.org
ns.adobe.com
sportservistocik.cz
apartmany.cucoriedka.sk

Embedded IP addresses

203.26.79.13
52.182.141.63
20.42.179.204
13.69.116.105
172.172.255.216
52.110.12.40
4.247.188.233
4.230.171.124
20.247.184.142
74.178.240.61
20.165.94.54
20.76.201.171
40.99.134.2
52.123.129.14
40.99.133.226
135.234.160.245
20.165.94.46
172.175.111.170
4.150.223.101

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report