MALICIOUS — b17ba90523f36329597d31ae4ed067c346ed131f6c31b042bf06bbe136f4ab5f

MALICIOUS — b17ba90523f36329597d31ae4ed067c346ed131f6c31b042bf06bbe136f4ab5f is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: b17ba90523f36329597d31ae4ed067c346ed131f6c31b042bf06bbe136f4ab5f
SHA-1: 1be232c2f8537db9436ed1aab3012350a229fc3e
MD5: d0183e1c44a621f99ed1fb8185de8fd8
ssdeep: 1536:BDU8uuxiOGLFeRbWs6sZLm72vTVY1dOHFTaQrOwDPp7WOpOaZWeAW1ij9zTbGz23:S7uCC3bZKibV7HFGQVaaZWe9ij9z2zEZ
TLSH: T14E38C0F35187DD8CB75B9F0369E6226CB04AF6882112D7A0508C7B6CC9BC9BD7D10A15
Submitted as: b17ba90523f36329597d31ae4ed067c346ed131f6c31b042bf06bbe136f4ab5f
File type: pdf · Size: 82451 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://xn--interpeas-r6a.es/upload/files/mixivomawobux.pdf - network signal, weight 0.70, confidence 0.80
Contacted 16 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://laborke.ru/uplcv?utm_term=love+me+like+you+do+song+download+mp4, https://stealthwindow.tw/uploads/files/202109061344259019.pdf, http://tecs4.com/intranet/ckfinder/userfiles/files/pupejifupadumod.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9654 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
250.255.255.239.in-addr.arpa
ntp.ubuntu.com
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 28ad7786a9f4a535f93f2b8e0866da883b7e9d6753828132f140761019b2a1a4
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\ab617c88cc7b7efbabedb1dbfc7c54a9.png - 1baa4e0c3c4237335562a6db2557e5ca22d416ad346fb6c845f8f6962c85af26
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://laborke.ru/uplcv?utm_term=love+me+like+you+do+song+download+mp4
https://stealthwindow.tw/uploads/files/202109061344259019.pdf
http://tecs4.com/intranet/ckfinder/userfiles/files/pupejifupadumod.pdf
https://smsenerji.com/resimler/files/vexuzezavov.pdf
http://xn--aknmedical-yub.com/uploads/file/rukarumebewolex.pdf
https://whereestar.com/marinarubicon/admin/file/diwozulojijoboja.pdf
https://www.hasmow.com.au/application/third_party/ckfinder/userfiles/files/8795760492.pdf
https://dichvumayphoto.vn/webroot/img/files/12393869776.pdf
https://xn--interpeas-r6a.es/upload/files/mixivomawobux.pdf
https://volpatoebrum.com.br/_common/admin/scripts/ckfinder/userfiles/files/44182566505.pdf
http://careerhack.net/wp-content/plugins/formcraft/file-upload/server/content/files/1613dec919a04e---58685599247.pdf
https://iieng.org/editor/ckfinder/userfiles/files/5793006970.pdf
https://pamukoglu.com/userfiles/file/72512231011.pdf
https://goez1.com/10005001208290177/ckfinder/userfiles/files/6280860281.pdf
http://naturalfurnish.com/userfiles/file/faraxuzukoxudatovis.pdf
http://tech-sub.com/userfiles/file/26066359175.pdf
https://www.horisunmauritius.com/wp-content/plugins/super-forms/uploads/php/files/f72a6fdf0c2604c1711ef0fb17d19574/sunowaxibikufomojeker.pdf
http://remont-etalon.ru/upload/files/zijevuforepitaz.pdf
http://185.33.116.145/~acus01/upload/files/vixibirifuxibubiboxe.pdf
http://www.stratcareerservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/16147643287e4e---63004507840.pdf
http://olivetheater.com/userData/board/file/biderupaselubuvanejo.pdf
https://architektor.ru/uploads/file/folod.pdf
https://jamisonfurnace.ca/userfiles/files/75059634653.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/

Embedded domains

laborke.ru
stealthwindow.tw
tecs4.com
smsenerji.com
xn--aknmedical-yub.com
whereestar.com
www.hasmow.com.au
xn--interpeas-r6a.es
volpatoebrum.com.br
careerhack.net
iieng.org
pamukoglu.com
goez1.com
naturalfurnish.com
tech-sub.com
www.horisunmauritius.com
remont-etalon.ru
www.stratcareerservices.com
olivetheater.com
architektor.ru
jamisonfurnace.ca
www.w3.org
purl.org
ns.adobe.com
dichvumayphoto.vn

Embedded IP addresses

185.33.116.145
4.150.223.102
20.184.175.17
52.110.12.25
52.110.12.52
52.230.60.54
4.230.171.124
52.168.117.175
20.76.201.171
74.178.76.128
52.123.129.14
52.123.252.213
72.154.7.17
203.26.79.13
51.116.253.169
4.150.223.112
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report