MALICIOUS — normal_60512a5d335e3.pdf

MALICIOUS — normal_60512a5d335e3.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: adccce14d7ec56c7e1382ae52633e52c33c01095f6a318379a4024f16897dde8
SHA-1: 054437a6c7ffdfb9fa5f0becb49c8a441f00279e
MD5: 94dca14387509e087d0fb92dd25544ef
ssdeep: 3072:IwLw7mJfLEc80PLqC8EcKGsbooUbqz7vbyrca/e44plHdo1mFP5wO:IMcIzEymlDk1UejcerplFb
TLSH: T1A340F2F3A297CD0D738A9B175EE62E65640DE64C6133DB15848D3B2C80F96BF2C51A20
Submitted as: normal_60512a5d335e3.pdf
File type: pdf · Size: 166868 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4416513/normal_5fecbedf9fe29.pdf - network signal, weight 0.70, confidence 0.80
Contacted 17 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://botokaw.ru/123?utm_term=best+online+mmorpg+games+for+android+2019, https://static.s123-cdn-static.com/uploads/4416513/normal_5fecbedf9fe29.pdf, http://nisarinu.epizy.com/best_bollywood_songs_site_free.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9650 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
desktop-hsgcbep
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\a4ed00d45783c99e2acd8cd42287b46b.png - 63a37ab742b511a00fcf42e4dccddd4a2f8c0ea59ac38703998f06712f17ffe8
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 859deb5eeaa83ad215983e29c80b9baaeb43b0fb3191f89cfbc765c22c1aeeeb
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://botokaw.ru/123?utm_term=best+online+mmorpg+games+for+android+2019
https://static.s123-cdn-static.com/uploads/4416513/normal_5fecbedf9fe29.pdf
http://nisarinu.epizy.com/best_bollywood_songs_site_free.pdf
https://cdn.sqhk.co/novimabe/icnAjdL/53120373857.pdf
https://fukukajapojuj.weebly.com/uploads/1/3/2/8/132815924/8973af973bffcd.pdf
https://cdn.sqhk.co/rotexopapi/bichbji/69163988692.pdf
https://cdn-cms.f-static.net/uploads/4465264/normal_603d2111b34e8.pdf
https://cdn.sqhk.co/pelebitebi/4phfMXA/dragon_ball_z_dokkan_battle_apkpure.pdf
http://raisinshub.pro/performance_appraisals_synonyms7771w.pdf
https://static.s123-cdn-static.com/uploads/4381546/normal_5ff222426a2b5.pdf
https://zobuboralol.weebly.com/uploads/1/3/4/4/134487340/2f4c1a9.pdf
http://gesizuwumog.iblogger.org/celluloid_guitar_pick_sheets.pdf
https://static.s123-cdn-static.com/uploads/4451927/normal_5fe0c2452efdf.pdf
http://svarka-aurora.online/lord_i_need_you_chords7tuyt.pdf
http://ijmalan.xyz/tamuvutexosiffqn6b.pdf
https://uploads.strikinglycdn.com/files/6762ebc2-7638-4944-90eb-a0d0483aad4b/evenflo_symphony_lx_all-in-one_car_seat_-_crete.pdf
https://uploads.strikinglycdn.com/files/699b8cc3-d4e9-4fd2-aea1-1ef6d379e4a7/ap_physics_1_answer_key.pdf
http://dijepitezuk.22web.org/13840716001.pdf
http://aycotoro0.xyz/icao_annex_17_amendment_14rwx9m.pdf
https://uploads.strikinglycdn.com/files/59d2c926-1b09-4907-965c-aa413b6eaca5/which_brand_of_robot_vacuum_is_the_best.pdf
https://rofokaragi.weebly.com/uploads/1/3/2/8/132815015/xikib.pdf
https://uploads.strikinglycdn.com/files/5a5c2794-5d55-4905-bef6-67e12216d651/sijumulamulixi.pdf
https://cdn.sqhk.co/sabiwizi/ibge8hd/dialog_sri_lanka_top_up.pdf
https://cdn.sqhk.co/nolovojawek/WYQhaif/how_mix_colors_to_make_brown.pdf
https://static.s123-cdn-static.com/uploads/4379385/normal_5fe526ad9d0c7.pdf

Embedded domains

botokaw.ru
static.s123-cdn-static.com
nisarinu.epizy.com
cdn.sqhk.co
fukukajapojuj.weebly.com
cdn-cms.f-static.net
raisinshub.pro
zobuboralol.weebly.com
gesizuwumog.iblogger.org
svarka-aurora.online
ijmalan.xyz
uploads.strikinglycdn.com
dijepitezuk.22web.org
aycotoro0.xyz
rofokaragi.weebly.com
bobalexes.iblogger.org
sovuberexizizir.epizy.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

20.165.94.46
135.232.92.34
172.66.2.5
4.230.171.124
4.149.210.175
74.179.77.204
51.11.192.51
74.179.71.159
72.154.7.97
52.123.128.14
52.123.129.14
203.26.79.13
135.233.45.221
92.223.78.30
135.234.160.245
172.170.180.133
20.42.65.91

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report