MALICIOUS — jivop.pdf

MALICIOUS — jivop.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 50 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: ae78431c39aca472c9d07400e45b234db23be75ca10151f5a7afa8b8b6796510
SHA-1: 2bef520cf2510e4bf5873d7f8b3fe75acd63f73d
MD5: e9a7f47295464d9c5eec18867aef8593
ssdeep: 1536:Bw3xMUnYjY/HRYYMFR4TeF7nPM5AZrP6alf6nhgWOpOwr5SKnW+lL5yKxzILoFZb:u3xMUn2uHqV0eF7nZialfch9wrYKNh5J
TLSH: T13C3AD0F3216BDD5C76CECF133AA621A5A4C5C7CC5226DA404048BB6CDAFC97EAE10650
Submitted as: jivop.pdf
File type: pdf · Size: 94329 bytes
Verdict: malicious (99/100)

Detections (4 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
Emsisoft (Emergency Kit): PDF.Spam.Heur.1

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Lazarus): root_.cache_dconf_user - dynamic signal, weight 0.80, confidence 0.90
Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 27 external host(s) at runtime (3 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://xn--eyt274i.com/upload/files/nipijawaju.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://wastran.ru/uplcv?utm_term=indian+iptv+apk+free, http://auto-rad.pl/userfiles/file/81406782628.pdf, http://kimura-shihoshoshi.com/userfiles/file/82016445579.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9696 behavior events · 1 ATT&CK techniques · 4 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
searchapp.bundleassets.example
inference.location.live.net
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
desktop-hsgcbep
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
79.243.254.169.in-addr.arpa
250.255.255.239.in-addr.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
23.40.52.85

Dropped files

/opt/CAPEv2/storage/analyses/24837/files/60b44ea4149e0507575115bc6818a18625a77c338252005db8034f458932d0bb - 60b44ea4149e0507575115bc6818a18625a77c338252005db8034f458932d0bb
/opt/CAPEv2/storage/analyses/24837/files/452f9ca5beaecf8a0c3e64807e88cd2c3c6f4225af049856c8e8f94ea6469c39 - 452f9ca5beaecf8a0c3e64807e88cd2c3c6f4225af049856c8e8f94ea6469c39
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
tmp_tmp.aLFGIhij0E - 522bc72a8732f77e351abcb72ae5a3c5305e18c642cc84f1178c8e6233548fcd

Embedded URLs

https://wastran.ru/uplcv?utm_term=indian+iptv+apk+free
http://auto-rad.pl/userfiles/file/81406782628.pdf
http://kimura-shihoshoshi.com/userfiles/file/82016445579.pdf
http://xn--eyt274i.com/upload/files/nipijawaju.pdf
http://ahknchem.com/upload/files/fapegifafafasupowovo.pdf
https://atolab.it/wp-content/plugins/super-forms/uploads/php/files/ed690a8d23af725b29816ffa0b3a6bc6/dijurada.pdf
https://www.adoz.cz/ckfinder/userfiles/files/lodoke.pdf
https://wittnebel.dk/file/76974250942.pdf
http://thevale.us/userimages/18885344566.pdf
https://juraganmonyet.com/contents/files/67771049977.pdf
http://arsvet.ru/img/upload/pezibeletu.pdf
https://www.paparazzirestaurant.com.au/wp-content/plugins/super-forms/uploads/php/files/fa588ae198053d885989ecc167a7bbf9/mejobu.pdf
http://formpart.com/upload/ckfinder/files/28155350452.pdf
http://meruzhankhachatryan.com/app/webroot/files/file/6972876259.pdf
http://madang.eu/f_pds/fck/file/wikesofimojotemixugizebi.pdf
http://loadcell.vn/Images_upload/files/gataxobuzijebimidubapoduv.pdf
http://jingyitech.com/uploadfile/69649148765.pdf
http://heatexchangersolution.com/upload_fck/file/2021-9-8/20210908060605800464.pdf
http://supair-lux.hu/ckfinder/userfiles/files/wazutigovakabutudorez.pdf
https://fundoohairstyles.com/hairstyler/images/file/88748932776.pdf
http://doanekeyes.com/userfiles/docs/33890595220.pdf
http://precisao.net/files/files/zudodesevivavixu.pdf
http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613105a54e83b---65780280339.pdf
http://kingsauto-bar.com/js/upload/files/buzoxikubenejawejuxukusus.pdf
http://ros-audit.com/i/up/file/bakukimozote.pdf

Embedded domains

wastran.ru
auto-rad.pl
kimura-shihoshoshi.com
xn--eyt274i.com
ahknchem.com
atolab.it
thevale.us
juraganmonyet.com
arsvet.ru
www.paparazzirestaurant.com.au
formpart.com
meruzhankhachatryan.com
madang.eu
jingyitech.com
heatexchangersolution.com
fundoohairstyles.com
doanekeyes.com
precisao.net
www.1000ena.com
kingsauto-bar.com
ros-audit.com
phucuongplus.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

85.210.196.11
4.150.223.110
51.104.15.253
57.155.104.224
74.178.76.44
74.178.76.128
52.123.252.247
52.110.12.10
20.165.94.46
4.247.188.224
172.178.240.162
52.178.17.235
162.159.36.2
40.103.64.226
4.230.171.124

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report