MALICIOUS — b277b0387d9d2d29da1fc46dc072a716fcf373b9d36ec1ade6166c6002208cf6

MALICIOUS — b277b0387d9d2d29da1fc46dc072a716fcf373b9d36ec1ade6166c6002208cf6 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: b277b0387d9d2d29da1fc46dc072a716fcf373b9d36ec1ade6166c6002208cf6
SHA-1: c43059e703210628a5a5509d2f7b419a5cf187fd
MD5: 6f85892bf8308258a1dd4a3a8ca9bc6f
ssdeep: 1536:diF5KxNj/GUP0HviY0LLrH95CvwOapTtex4X+FfVbJWGpOKCW5cFCMdE5pELRJiO:AFkxNjKxqrd5wwPpTtBuFfVb+KYoMKpa
TLSH: T1BB38D1E310DBEC4C779BEB4725AB01A9A489C3545433EFA01088BB7C65BC67EBE04651
Submitted as: b277b0387d9d2d29da1fc46dc072a716fcf373b9d36ec1ade6166c6002208cf6
File type: pdf · Size: 83703 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 17 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://www.psstrecno.sk/wp-content/plugins/formcraft/file-upload/server/content/files/161592ec425cf3---90702402642.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://smidgel.ru/uplcv?utm_term=sloth+deadly+sin, https://www.lang-mayer.de/wp-content/plugins/formcraft/file-upload/server/content/files/161528a7dba99d---vugepawelatis.pdf, http://beccaro.it/userfiles/files/83376534043.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9659 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
ntp.ubuntu.com
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
desktop-hsgcbep
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\38128d69e05fcb51660d7e896f535eee.png - 9fd5e6d69d81fce02351042dd7f8c9237cab6e8f3d1b6370efc95dd085dfcfdc
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - eb6eb5b35eeed3bb414e073d184a2c1fd0a8cd099671352002dee664bd36ba88
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://smidgel.ru/uplcv?utm_term=sloth+deadly+sin
https://www.lang-mayer.de/wp-content/plugins/formcraft/file-upload/server/content/files/161528a7dba99d---vugepawelatis.pdf
http://beccaro.it/userfiles/files/83376534043.pdf
https://novsport.com/content/File/xevunukotitipenozaduge.pdf
https://cbolean.com/wp-content/plugins/super-forms/uploads/php/files/fa08b0a091ed22b0331a4d98b6ff3fe8/54346947381.pdf
http://whuntex.ru/userfiles/file/wixijutupozejoterivib.pdf
https://www.assessment.unibe.ch/app/webroot/js/ckfinder/userfiles/files/53578859484.pdf
http://pure-chiral.com/upload/files/lodajalodevojerakekirurin.pdf
http://www.psstrecno.sk/wp-content/plugins/formcraft/file-upload/server/content/files/161592ec425cf3---90702402642.pdf
http://ericshartman.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/mofiko.pdf
https://datawire.gr/files/files/90029332660.pdf
http://www.kinoimaging.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1615c9dc1d7e7c---85395339004.pdf
http://henzefashion.com/userfiles/file/15340361137.pdf
http://www.badischer-kunstverein.de/ckfinder/userfiles/files/68821847028.pdf
https://telechips.com/ckfinder/userfiles/files/tusokafupofaj.pdf
https://dalycity.com/wysiwygfiles/file/99953698858.pdf
http://aedelsur.com/contenido/files/17720762737.pdf
http://baodieptailor.com/uploads/2021-10-01/images/files/77720412035.pdf
https://myclubowners.com/userfiles/files/mogigovinebixixojuwe.pdf
https://www.seblocation.com/ckfinder/userfiles/files/15585895713.pdf
http://lagrupacio.cat/file/43722809071.pdf
http://businessplan-capalpha.fr/mbp/upload/images/images/upload/ckfinder/78131850425.pdf
http://delfosventures.com/userfiles/files/25067476867.pdf
http://ykzn8.com/upfiles/editor/files/27639423750.pdf
http://sandiego.songhakbbq.com/uploads/files/16196152802.pdf

Embedded domains

smidgel.ru
www.lang-mayer.de
beccaro.it
novsport.com
cbolean.com
whuntex.ru
www.assessment.unibe.ch
pure-chiral.com
ericshartman.com
www.kinoimaging.nl
henzefashion.com
www.badischer-kunstverein.de
telechips.com
dalycity.com
aedelsur.com
baodieptailor.com
myclubowners.com
www.seblocation.com
businessplan-capalpha.fr
delfosventures.com
ykzn8.com
sandiego.songhakbbq.com
precisionautoandac.com
www.w3.org
purl.org

Embedded IP addresses

74.178.232.29
20.184.175.23
52.110.12.25
4.230.171.124
172.215.188.225
52.230.59.222
52.168.112.66
20.231.239.246
20.165.94.63
74.178.240.61
52.123.128.14
40.103.64.242
135.233.45.223
74.179.71.159
203.26.79.13
4.150.223.115
92.223.78.30

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report