MALICIOUS — ae4a1caeaa33ba11d7ff1b5939d7a6dec2bce6759371310e22f6d818f985ffdc

MALICIOUS — ae4a1caeaa33ba11d7ff1b5939d7a6dec2bce6759371310e22f6d818f985ffdc is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: ae4a1caeaa33ba11d7ff1b5939d7a6dec2bce6759371310e22f6d818f985ffdc
SHA-1: a9891e69c1b10dfc264d682b078797e2b0b67ee5
MD5: b56f15b61b778de6399db061e33dfb4f
ssdeep: 1536:Ov7xvzRU2gGq/ZldJLhTWPlHAPqWapOtQHWdxSq9+2hUU:I7jSGiJLhiPBAPXtQ9qt5
TLSH: T1E538BFF76187DE4C779B9F036DE601ACA08AE7C46162DB5080C8B66CC57CABEBE10511
Submitted as: ae4a1caeaa33ba11d7ff1b5939d7a6dec2bce6759371310e22f6d818f985ffdc
File type: pdf · Size: 81931 bytes
Verdict: malicious (97/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 97/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://leton.pl/userfiles/file/fisopejezejugumoxene.pdf - network signal, weight 0.70, confidence 0.80
Embedded network infrastructure: https://pixomot.ru/uplcv?utm_term=vida+de+una+geisha+pdf, http://bhttourist.com/upload/fckimagesfile/kumazeruvodedalezajuzet.pdf, http://lnhaihui.com/userfiles/file/20210907021602_27501437.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Contacted 21 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9722 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
_dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 0d005513791e76373aeb43fd1869c7ca3b8a549f2fb88c6b5a65bcace74c24fc
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\c8e61481b283b333fce67dd0c6e0abd2.png - 1e68d6ec0a7f4e40fa45be7ff1db5035469091b8342f13781b1306ff11e4c0cc
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://pixomot.ru/uplcv?utm_term=vida+de+una+geisha+pdf
http://bhttourist.com/upload/fckimagesfile/kumazeruvodedalezajuzet.pdf
http://lnhaihui.com/userfiles/file/20210907021602_27501437.pdf
http://pileki.com/imgup/file/84211380662.pdf
https://traffictkt.com/viking1/uploads/files/6795097060.pdf
http://leton.pl/userfiles/file/fisopejezejugumoxene.pdf
https://vetregistr.com/ckfinder/userfiles/files/78110029831.pdf
https://mzr-avocats.com/buddha/ckfinder/userfiles/files/sabaxerawofogotalibe.pdf
http://nationalherbo.com/userfiles/file/zomegufimifadi.pdf
https://shining4u.com/wp-content/plugins/super-forms/uploads/php/files/7a93ef56ff913d0925b147b28e8fe7db/82086253351.pdf
https://fertilizerproductionprocess.com/d/files/bokugazinuwuvekela.pdf
https://sapporomn.com/userfiles/files/lamixuditopufifetumefonem.pdf
http://risorsaterra.it/userfiles/files/63653568700.pdf
http://gz-chengeng.com/uploadfile/files/fujotu.pdf
https://kingyao.com/uploadfiles/files/20210908_065600_7153.pdf
https://atlastoursntravels.com/userfiles/file/54566262413.pdf
http://www.trackls.com/application/ckeditor/ckfinder/userfiles/files/luvaze.pdf
http://amwordpress.org/wp-content/plugins/formcraft/file-upload/server/content/files/16137c9fab8728---sofojedujit.pdf
https://weborder.cloud/userfiles/file///44797036812.pdf
http://3mfa.com/images/editor/files/masotuval.pdf
https://ateneoarbonaida.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613044c09cbed---tekomitaputexoponigosel.pdf
https://leunamgroup.com/wp-content/plugins/super-forms/uploads/php/files/e39bd75a57a34b848e88096873c4deaf/10715155428.pdf
http://islenapuntos.com/campannas/file/41369445094.pdf
https://www.opdrrustukalac.com/wp-content/plugins/formcraft/file-upload/server/content/files/161422b33e30c0---dewofug.pdf
http://katyababash.com/images/uploads/file/metugugeluji.pdf

Embedded domains

pixomot.ru
bhttourist.com
lnhaihui.com
pileki.com
traffictkt.com
leton.pl
vetregistr.com
mzr-avocats.com
nationalherbo.com
shining4u.com
fertilizerproductionprocess.com
sapporomn.com
risorsaterra.it
gz-chengeng.com
kingyao.com
atlastoursntravels.com
www.trackls.com
amwordpress.org
weborder.cloud
3mfa.com
ateneoarbonaida.com
leunamgroup.com
islenapuntos.com
www.opdrrustukalac.com
katyababash.com

Embedded IP addresses

135.232.92.34
74.178.76.128
20.42.65.90
20.42.65.93
52.123.252.245
52.110.12.11
4.230.171.124
40.84.85.40
52.230.59.222
52.123.252.239
74.179.77.164
135.233.95.144
20.76.201.171
52.123.129.14
20.165.94.63
92.223.78.30
20.165.94.46
172.175.111.170
20.42.73.28
20.42.73.26
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report