MALICIOUS — 16137b60884f3e---fijatefisarufudenebe.pdf

MALICIOUS — 16137b60884f3e---fijatefisarufudenebe.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: ae04edecc35ac2a8d694dd4967a842cec7d9fc4a04bfc58891edb0038c5d09e9
SHA-1: 76b75e426e3bfcddbd21b821c8519f21f80ed531
MD5: 2c6cdebfef3b4c33683f610ffaa0df89
ssdeep: 1536:QhC6SddU1JS8qXqZ1AssUwFiaBi3/bk2JqWFqTV87SGFOoR4O3g8ZWcpOm5UVV:xngSB6Z1AssEas3qpBGDRrTQmmL
TLSH: T1C63AE1F330D7ED9C768BDB0369EB5668A047E79850A3E9608088B63C85BC27E7F14511
Submitted as: 16137b60884f3e---fijatefisarufudenebe.pdf
File type: pdf · Size: 94273 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://jtylek.pl/Upload/file/77582029854.pdf - network signal, weight 0.70, confidence 0.80
Contacted 15 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://jtylek.pl/Upload/file/77582029854.pdf, https://www.apartamentselsllacs.com/wp-content/plugins/super-forms/uploads/php/files/6resefmsn1c9ln58t3v7jr7jk7/mobusotiwuzigeraj.pdf, https://dipinkrishna.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609b7277c1e70---nuxofimoduwigomesita.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9728 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
252.0.0.224.in-addr.arpa
255.255.254.169.in-addr.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
79.243.254.169.in-addr.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
ntp.ubuntu.com
desktop-hsgcbep
http://www.msftconnecttest.com/connecttest.txt

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\29cf93ca8573f9d4086efe7f0252b778.png - 1f8b978fcb31dce16de1c80549190a095a9644adc820ee86b437b9f12f52a908
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 1ad7a36a5b5db25efbdc5260ca8d5a99888e344bd0a2012aaaaa8ce3debd251b
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/fzgW7-mxBc0/uplcv?utm_term=importance+of+technology+in+the+workplace+pdf
http://jtylek.pl/Upload/file/77582029854.pdf
https://www.apartamentselsllacs.com/wp-content/plugins/super-forms/uploads/php/files/6resefmsn1c9ln58t3v7jr7jk7/mobusotiwuzigeraj.pdf
https://dipinkrishna.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609b7277c1e70---nuxofimoduwigomesita.pdf
http://princeworldwide.com/multimedia/userfiles/file/43068459856.pdf
https://www.duffylighting.com/wp-content/plugins/super-forms/uploads/php/files/4adc266faca254d8c42ff59d5a127ce8/putupuzidenanawa.pdf
http://willtorock.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608b861539b44---wodenikotebiga.pdf
https://moiatakashta.com/userfiles/file/47356216794.pdf
https://www.eziblank.com/wp-content/plugins/super-forms/uploads/php/files/o6uul85jvh301fd87e3e3eucd3/lokalupinur.pdf
https://www.gsccn.it/wp-content/plugins/formcraft/file-upload/server/content/files/16134bd8ddb7b2---rowoxeruka.pdf
https://joinvita.com/neu/userfiles/file/31686731992.pdf
http://kargo-box.com/uploads/files/39543393559.pdf
https://guptajimarriagebureau.com/userfiles/file/7881142236.pdf
http://kursadowicz.pl/Upload/file/98376175167.pdf
http://fsnmmaterials.com/UPFILE/userfiles/files/nisilaxanopaxewini.pdf
http://theydeserveastamp.org/wp-content/plugins/formcraft/file-upload/server/content/files/161226792028b6---jananaxez.pdf
http://oldtimerclub-thueringerberg.at/images/file/podixi.pdf
https://rajatotogroup2.com/contents//files/89508424982.pdf
http://sequirk.ie/userfiles/file/xejovexenidoletexakorigo.pdf
http://poongdung.com/FileData/ckfinder/files/20210728_3E7B8C16A52A3053.pdf
http://memsports.com.br/admin/libs/ckeditor/ckfinder/files/pazepojoregigalupusudi.pdf
https://www.alongsideasia.com/wp-content/plugins/super-forms/uploads/php/files/cbf81e2e00f0ef8003944514fd010bc4/nivagaledujesuwiwiporamuj.pdf
http://dynamic1984.com/user_file/file/jinodabetenumurir.pdf
http://www.commandinglife.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bb9fc1c5abd---dexezedubomakobufa.pdf
http://lichnyiybrand.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1612f945d42cab---talab.pdf

Embedded domains

feedproxy.google.com
jtylek.pl
www.apartamentselsllacs.com
dipinkrishna.com
princeworldwide.com
www.duffylighting.com
willtorock.com
moiatakashta.com
www.eziblank.com
www.gsccn.it
joinvita.com
kargo-box.com
guptajimarriagebureau.com
kursadowicz.pl
fsnmmaterials.com
theydeserveastamp.org
rajatotogroup2.com
poongdung.com
memsports.com.br
www.alongsideasia.com
dynamic1984.com
www.commandinglife.com
lichnyiybrand.ru
www.w3.org
purl.org

Embedded IP addresses

51.104.15.252
172.172.255.216
20.42.65.88
4.144.132.223
52.110.12.1
4.230.171.124
135.232.92.34
74.179.77.204
203.26.79.13
20.42.65.84
52.123.128.14
40.84.85.40
92.223.78.30
172.178.240.162
48.192.143.121

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report