MALICIOUS — b0b4f5af3bb24d70a46d7adebd9f93b7ab5d5f1af3a49a8d2ed36fe757e64db5

MALICIOUS — b0b4f5af3bb24d70a46d7adebd9f93b7ab5d5f1af3a49a8d2ed36fe757e64db5 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: b0b4f5af3bb24d70a46d7adebd9f93b7ab5d5f1af3a49a8d2ed36fe757e64db5
• SHA-1: cb673ca33053f2b1d433aa2cc563eb4de7f34462
• MD5: 80700849df9a790865bf6e3424ea909e
• ssdeep: 1536:wrcTzmeMJTv1AzDj9W5K9UpFPcL812W+JMZNLzDvwb:OOyDj1Azf9QuUpl1u0XD8
• TLSH: T11D37E0F3B15BDD8C3AC7674399E7241C204EC2886632EB740488B66CD5B87BDBE14A41
• Submitted as: b0b4f5af3bb24d70a46d7adebd9f93b7ab5d5f1af3a49a8d2ed36fe757e64db5
• File type: pdf · Size: 76499 bytes
• Verdict: malicious (98/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!80700849DF9A
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1105
• T1566.002

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated malicious by URL analysis: http://phillipwhiting.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c77ba074ec---jodazerolozebajebu.pdf - network signal, weight 0.70, confidence 0.80
• Contacted 20 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
• Embedded network infrastructure: http://thm-holding.ru/wp-content/plugins/super-forms/uploads/php/files/fb92028bcdeb25926556928f1337bed6/tamovifezudor.pdf, https://kakvkusno26.ru/wp-content/plugins/super-forms/uploads/php/files/54057a19350366964f08d48bf2ce4e7a/75970900498.pdf, http://phillipwhiting.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c77ba074ec---jodazerolozebajebu.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9693 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• desktop-hsgcbep
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• ntp.ubuntu.com
• 250.255.255.239.in-addr.arpa
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Dropped files

• C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\0e8d7393a2c98e2a22106a990d6a0465.png - 35adc4e9ff3d69b9b6b1ce441d528ba1b503ba63a955ed65f108616397fb9afd
• C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 78919acb666c075a65926d25a2386a530fa87230143f5f217d304c046def8aaa
• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://feedproxy.google.com/~r/Uplcv/~3/DOqCt-cVA4I/uplcv?utm_term=cabo+san+lucas+fishing+report+june+2019
• http://thm-holding.ru/wp-content/plugins/super-forms/uploads/php/files/fb92028bcdeb25926556928f1337bed6/tamovifezudor.pdf
• https://kakvkusno26.ru/wp-content/plugins/super-forms/uploads/php/files/54057a19350366964f08d48bf2ce4e7a/75970900498.pdf
• http://phillipwhiting.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c77ba074ec---jodazerolozebajebu.pdf
• http://zadonskiy.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1606f697b78651---93113842398.pdf
• https://www.hadlowsecurityshutters.com/wp-content/plugins/super-forms/uploads/php/files/6e59de40c0b52c10f157922082725ea4/tajum.pdf
• https://earthchartercities.org/wp-content/plugins/formcraft/file-upload/server/content/files/16091c3b40b4d3---kexisebidizufawapelalasi.pdf
• https://home18.ru/wp-content/plugins/super-forms/uploads/php/files/7fe0eb32bfff49ef50855a61cc6a8b94/89872921126.pdf
• https://archltginc.com/wp-content/plugins/super-forms/uploads/php/files/59edf9182332bf416f3bb147aeafdf5c/niwitupugenelag.pdf
• http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/16080f1d80f6a7---vavubozed.pdf
• https://www.superioreagle.com/wp-content/plugins/formcraft/file-upload/server/content/files/160940aef4b33e---povuzedajanuzuk.pdf
• http://antwerp-rentals.com/wp-content/plugins/formcraft/file-upload/server/content/files/160745699b408a---99378213381.pdf
• http://www.rebranded.tv/wp-content/plugins/formcraft/file-upload/server/content/files/16093a4a70103d---32926277996.pdf
• http://remontnoedelo.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16099fdb1a7d46---70162789985.pdf
• https://pfgmm.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/16084b1b9e2ea8---59389655242.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

• feedproxy.google.com
• thm-holding.ru
• kakvkusno26.ru
• phillipwhiting.com
• zadonskiy.ru
• www.hadlowsecurityshutters.com
• earthchartercities.org
• home18.ru
• archltginc.com
• www.1000ena.com
• www.superioreagle.com
• antwerp-rentals.com
• www.rebranded.tv
• remontnoedelo.ru
• pfgmm.com.au
• www.w3.org
• purl.org
• ns.adobe.com

Embedded IP addresses

• 85.210.193.152
• 4.150.223.115
• 162.159.142.9
• 40.79.150.122
• 20.247.184.142
• 52.123.252.192
• 172.215.188.232
• 4.230.171.124
• 20.165.94.63
• 74.179.77.164
• 13.69.116.105
• 52.182.141.63
• 40.99.133.226
• 52.123.128.14
• 135.232.92.34
• 203.26.79.13
• 92.223.78.30
• 20.184.175.20
• 48.199.12.1
• 104.46.162.224

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report