MALICIOUS — b26e3aed40d75c32cab24288286bdb4b4c9981bfa7b430d73d6455efd80ca964

MALICIOUS — b26e3aed40d75c32cab24288286bdb4b4c9981bfa7b430d73d6455efd80ca964 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: b26e3aed40d75c32cab24288286bdb4b4c9981bfa7b430d73d6455efd80ca964
SHA-1: f48691e8ac25fc4dc82b9515e44d0813fd287ea5
MD5: fff35c8924023a7d89f8086c7f806737
ssdeep: 1536:r9CWYK+wWTP8UZgOYj1eLA+uxtgmClp13vT5HnFNrSCWGQu6agE8CXSk6W6pOu2B:RMK0rGV0A+uxtk13vT5HF1DQuQE8xkH1
TLSH: T1993ACFB721DBDE5C7A858F0335A721ACB085CB8C2176AA5094CCB67CD5BC4BE7B00991
Submitted as: b26e3aed40d75c32cab24288286bdb4b4c9981bfa7b430d73d6455efd80ca964
File type: pdf · Size: 97680 bytes
Verdict: malicious (95/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 95/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 14 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://srihemkuntsahibfgp.org/hemkunt/userfiles/file/88132090233.pdf, https://kaimano.it/file/9890856349.pdf, https://www.baust.edu.bd/app/webroot/ckfinder/userfiles/files/49939887626.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9766 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
_dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787919680&P2=404&P3=2&P4=DXKjdVBIiMvj0lnmA0Tk5z%2bCTQGJU9NzeOgr5rqUSna5cfcW%2bRRNS8CLbt69xnAecGsavhZKR4R47Fj3PwvKdw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 2caa6316c4a003a098af8f779d84858b5738f47c42d4a49f1f8d5a228eda5c86
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\56fc8e750dfbf215f6e75f3c4e690544.png - dd57b0915202a5de58c4abedbe724a9385ba15148e9a5e23b95803835f4ac27c
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/1xuhb7AK25c/uplcv?utm_term=all+about+occult
http://srihemkuntsahibfgp.org/hemkunt/userfiles/file/88132090233.pdf
https://kaimano.it/file/9890856349.pdf
https://www.baust.edu.bd/app/webroot/ckfinder/userfiles/files/49939887626.pdf
https://brusroom.com/wp-content/plugins/super-forms/uploads/php/files/f97631a892a17b0b2160f5373a55bd64/42896519571.pdf
http://openendrep.com/userfiles/files/4760117503.pdf
https://kodeac.com/wp-content/plugins/super-forms/uploads/php/files/0c52lc9ddevjs80sjj0sbsmpm8/wufigojemilomemevuvopon.pdf
http://willajarmar.pl/userfiles/file/dapolumozozetejemevakab.pdf
https://vieclamlaocai.vn/webroot/img/files/jolanux.pdf
http://castel.lu/userfiles/files/kofewiwenixoruse.pdf
http://shahgrp.com/uploads/12026108611.pdf
https://mwasafat.com/uploads/files/24546478818.pdf
http://lpxs168.com/filespath/files/20210924052059.pdf
https://mimpishio.com/contents/files/niken.pdf
http://www.otevrenysklep.cz/ckfinder/userfiles/files/wobokuwemevevimozu.pdf
http://nyitotthetvege.kastelyszallodak.hu/userfiles/files/tuxamiji.pdf
http://fotostudiovaccari.it/userfiles/files/61514231528.pdf
http://allamericannursing.com/userfiles/file/88241459530.pdf
http://jlicentral.com/images/authors/file/jojatepebavuwevosa.pdf
http://honyi.tw/ckfinder/userfiles/file/zewagogebebisefi.pdf
http://trlgpc.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/80821904178.pdf
http://teknis.it/userfiles/files/53635472410.pdf
http://behtarinekhodetbash.com/files/files/guzuninuwifazivutetufepe.pdf
http://importfoodfair.com/userfiles/image/2021/09/file/lekipusonerawagixawo.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

feedproxy.google.com
srihemkuntsahibfgp.org
kaimano.it
brusroom.com
openendrep.com
kodeac.com
willajarmar.pl
shahgrp.com
mwasafat.com
lpxs168.com
mimpishio.com
fotostudiovaccari.it
allamericannursing.com
jlicentral.com
honyi.tw
trlgpc.com
teknis.it
behtarinekhodetbash.com
importfoodfair.com
www.w3.org
purl.org
ns.adobe.com
www.baust.edu.bd
vieclamlaocai.vn
castel.lu

Embedded IP addresses

52.110.12.51
4.247.188.224
4.230.171.124
74.179.77.204
135.232.92.97
52.123.129.14
135.233.45.221
52.123.252.202
203.26.79.13
74.178.76.44
4.209.250.170
4.150.223.111
20.184.175.20
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report