MALICIOUS — b1cbc5636572a0d41fa52b9f4d6458902a46c21bd22c0e37ba1d7e619cb10928
MALICIOUS — b1cbc5636572a0d41fa52b9f4d6458902a46c21bd22c0e37ba1d7e619cb10928 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100). 5 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
b1cbc5636572a0d41fa52b9f4d6458902a46c21bd22c0e37ba1d7e619cb10928 - SHA-1:
c8fa9c7c9b6d2faaf520cece74492847e115062f - MD5:
ea8a2ca9f415a64a391243537224578b - ssdeep:
1536:+Vd0x7eJH/os2O7qGUkFJUPRNW2ABmtr6tje6zCsU:i0xSJfouruP22ttrGje6zA - TLSH:
T13837D0F361E7ED4CBE5E5F4368A7211C55C9D39822339B944488393CC5BCBAEAE20550 - Submitted as: b1cbc5636572a0d41fa52b9f4d6458902a46c21bd22c0e37ba1d7e619cb10928
- File type: pdf · Size: 75752 bytes
- Verdict: malicious (95/100)
Detections (5 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Trellix Stinger (McAfee): PDF/Phish-FAB!EA8A2CA9F415
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 95/100 is the fusion of 6 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule
Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95 - Contacted 18 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://jottigo.ru/award?keyword=addition+and+subtraction+test+grade+4+pdf, https://cdn.sqhk.co/zimuteraf/jNjingi/police_siren_noise_download.pdf, http://kogiwonewaveg.iblogger.org/airlift_performance_air_tank.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Extracted generic config (12 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
9736 behavior events · 0 ATT&CK techniques · 3 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- c.pki.goog
- ntp.ubuntu.com
- 250.255.255.239.in-addr.arpa
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787920551&P2=404&P3=2&P4=M9WE%2fsIkT%2bpfl0TGT%2bPILTZ%2fHEMTPlHgBWxZ30Y9XwZs2kWZZxhaIdEfRNYIa6xocGOGGaOVjrDsXHvxNWgjHg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787920602&P2=404&P3=2&P4=PONOetGWJ7znTbbYRhiPknY%2bWjCRztxJJUjc%2fnvlUQE7618Tj9Dd8Xnl5gPpGgjgu2NhfepW3k0OjVNdKFCSBA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Dropped files
- C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\82633110a22627813c754b39d9af52fb.png -
94f4b752c0716f60aae2fd5635476c30199db7c6769ef4a00f584c5ab6770656 - C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt -
a2c750bbe3a509888f9aaf47ea163e36f40128eeccb71c605f7696bde624cf4c - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://jottigo.ru/award?keyword=addition+and+subtraction+test+grade+4+pdf
- https://cdn.sqhk.co/zimuteraf/jNjingi/police_siren_noise_download.pdf
- https://s3.amazonaws.com/kasuwevovog/4715473541.pdf
- https://s3.amazonaws.com/vebisop/madusufejupamujul.pdf
- http://kogiwonewaveg.iblogger.org/airlift_performance_air_tank.pdf
- http://xikusaduxofi.atwebpages.com/8566724897.pdf
- https://s3.amazonaws.com/xupimaral/attack_on_titan_season_2_recap_for_season_3.pdf
- https://s3.amazonaws.com/tajimipojimo/black_and_decker_jigsaw_js660_parts.pdf
- https://s3.amazonaws.com/fajeloninesitel/wepalipivel.pdf
- https://s3.amazonaws.com/fexuror/fowatadabek.pdf
- http://xiromenabagagi.rf.gd/cashier_cv_format_in_word.pdf
- https://cdn.sqhk.co/bevoroxur/egiAiar/52130786091.pdf
- https://cdn.sqhk.co/dagosasojo/1YXidhd/tukezuzuzelif.pdf
- http://nuneriwu.22web.org/malware_antivirus_free_for_windows_xp.pdf
- https://s3.amazonaws.com/nezanurugega/kuwadazagaxi.pdf
- https://s3.amazonaws.com/zuwosil/xevevidu.pdf
- http://megidexabaror.mywebcommunity.org/cricket_batting_tips_in_tamil.pdf
- http://samafutanub.mypressonline.com/craftsman_10hp_30_riding_mower_parts.pdf
- https://cdn.sqhk.co/dijogiper/cSVsTgi/sanibonixot.pdf
- http://robabunegulawi.rf.gd/1956445572.pdf
- http://fadewujetenuve.mywebcommunity.org/bunarujanupaxaduw.pdf
- https://s3.amazonaws.com/gusule/zukaf.pdf
- https://cdn.sqhk.co/guxuboru/4iiifmv/clock_face_image_generator.pdf
- http://xesunuz.epizy.com/kebebe.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- jottigo.ru
- cdn.sqhk.co
- s3.amazonaws.com
- kogiwonewaveg.iblogger.org
- xikusaduxofi.atwebpages.com
- nuneriwu.22web.org
- megidexabaror.mywebcommunity.org
- samafutanub.mypressonline.com
- fadewujetenuve.mywebcommunity.org
- xesunuz.epizy.com
- www.w3.org
- purl.org
- ns.adobe.com
- xiromenabagagi.rf.gd
- robabunegulawi.rf.gd
Embedded IP addresses
- 135.233.95.80
- 52.110.12.33
- 4.230.171.124
- 72.153.5.131
- 57.155.104.224
- 203.26.79.13
- 4.144.132.223
- 51.116.246.106
- 20.231.239.246
- 52.123.128.14
- 40.99.133.210
- 74.178.76.128
- 20.42.73.26
- 52.123.252.198
- 20.42.179.204
- 48.211.4.16
- 4.150.223.110
- 48.199.12.1
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report