MALICIOUS — b143e8bedb7dfa62a51d91e5033975dfa6b9f09cea64d5927f23da39c3d01dfe

MALICIOUS — b143e8bedb7dfa62a51d91e5033975dfa6b9f09cea64d5927f23da39c3d01dfe is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: b143e8bedb7dfa62a51d91e5033975dfa6b9f09cea64d5927f23da39c3d01dfe
SHA-1: c65dfd2905aa43973680edfe86fe577dc6b99cee
MD5: d4b5f6707630564028fde67685f24d0b
ssdeep: 1536:N0nh+Ju+1JYGFiJ4OWUZ8J7XcHQgXWCpOVikDmOdUChO0WaeQHHkc6f:mh61JjiJTZ8pxfViSm8UzezHw
TLSH: T18238C0F3118BDD5C664BCB03ACFA1179A98AD389A131DB909488F36CD5BC5BDBE10910
Submitted as: b143e8bedb7dfa62a51d91e5033975dfa6b9f09cea64d5927f23da39c3d01dfe
File type: pdf · Size: 83870 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://vector-food.pl/userfiles/file/gatupenebonisuxevofox.pdf - network signal, weight 0.70, confidence 0.80
Contacted 18 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://vector-food.pl/userfiles/file/gatupenebonisuxevofox.pdf, http://coreaad.com/DreamDataUpload/file/78641651172.pdf, http://fsgzb.com/upfolder/e/files/20210929120432.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9715 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787881551&P2=404&P3=2&P4=c57LIfmlDJ4%2bvYnHBnrgqFRTxCOLViTTfCP1C5WdEMk9K1FbxpAcad4GqWTEIONWytg54uteJg7a47IhjpNZcg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787881633&P2=404&P3=2&P4=QU5aZ%2bOtqM1pWsaidZOjtfJrZC251Aqmjd%2bJri%2bByALO3B2Au33LaHCRt%2fZ%2fbeRERmgOGV7AbwkkU48VsMwbbA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 599f2f2e29f0aa42dd8642988e89f94f24aba7aa26a078d74f3b76ed43ff67cc
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\655fe3a8b3a973b48fa2453164f1cbaa.png - d10e3193cb8a8c071e4f77c1fcbe9ea20f365ca271fdd57bea70451628b3f587
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/6naE_Nh8_CY/uplcv?utm_term=competition+wizard+geography+pdf
http://vector-food.pl/userfiles/file/gatupenebonisuxevofox.pdf
http://coreaad.com/DreamDataUpload/file/78641651172.pdf
http://fsgzb.com/upfolder/e/files/20210929120432.pdf
https://israelonthehouse.com/wp-content/plugins/formcraft/file-upload/server/content/files/16160229780ed0---xemasuzufevira.pdf
http://veszpremlizards.hu/_user/file/bolurage.pdf
http://brunagabriele.it/userfiles/files/62502319345.pdf
https://ferest.ro/imagini_ws/48597384975.pdf
http://uniquecharacters.com/upload/files/13664076616.pdf
https://bloomlight.pl/_bloom/file/xuzepozukitozigipejegax.pdf
http://chocolatycakes.com/wp-content/plugins/formcraft/file-upload/server/content/files/1615c61cd672d0---nojogiwififanaw.pdf
http://vuoncotichdep.com/upload/files/9442441024.pdf
http://cathyknightwaite.com/ckfinder/userfiles/files/78164800473.pdf
https://bdaudit.ro/userfiles/file/bomonabobew.pdf
http://elementsgogreen.com/userfiles/file/14196182608.pdf
http://kliknetezde.cz/admin/obrazky/file/zukudovusezisebepolegedo.pdf
http://global-gypsum.com/wp-content/plugins/formcraft/file-upload/server/content/files/161333fe8853f4---18697247399.pdf
http://agataklimowska.pl/userfiles/file/74145941402.pdf
https://eliteplacementagency.com/uploads/files/sivinasizofezoxo.pdf
http://chip-chup.hu/upload/file/43775540377.pdf
http://patrick-jardinage.fr/ckfinder/userfiles/files/75226932848.pdf
http://kingswaytyres.com/project/kingsway/uploads/file/bobijonisupololatiwadunik.pdf
http://www.miamiairportlimo.net/wp-content/plugins/formcraft/file-upload/server/content/files/1614bf202c0908---9259730367.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/

Embedded domains

feedproxy.google.com
vector-food.pl
coreaad.com
fsgzb.com
israelonthehouse.com
brunagabriele.it
uniquecharacters.com
bloomlight.pl
chocolatycakes.com
vuoncotichdep.com
cathyknightwaite.com
elementsgogreen.com
global-gypsum.com
agataklimowska.pl
eliteplacementagency.com
patrick-jardinage.fr
kingswaytyres.com
www.miamiairportlimo.net
www.w3.org
purl.org
ns.adobe.com
veszpremlizards.hu
ferest.ro
bdaudit.ro
kliknetezde.cz

Embedded IP addresses

172.66.2.5
20.247.184.197
135.232.92.34
48.211.4.16
4.230.171.124
72.145.35.108
203.26.79.13
20.165.94.63
135.232.92.97
4.150.223.99
52.123.129.14
40.103.64.226
74.179.77.204
52.123.252.235
74.179.71.159
20.42.73.27
20.42.65.93
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report