MALICIOUS — b3b31b9e853fb84450504c7ce9d905eddbe618ed6b575959505c73dd23fbce7e

MALICIOUS — b3b31b9e853fb84450504c7ce9d905eddbe618ed6b575959505c73dd23fbce7e is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: b3b31b9e853fb84450504c7ce9d905eddbe618ed6b575959505c73dd23fbce7e
SHA-1: 75e6d592d13e9e986a404a834de4056131697001
MD5: bf6d62c620237d11daeccaf930186f9a
ssdeep: 1536:cAIBIDYkkVoOvAb3D/OcbxYHIIA9ojshMyIbn+JBMQ/WZdjcIPWxApOG53PUxG:5IBmOvA2cbKkojshMy7/58QIQ3GFv
TLSH: T1B438C0F371A7DC8CBB879F0768DA1168908AD7986233DFA04088B7BC89BC57D6E00551
Submitted as: b3b31b9e853fb84450504c7ce9d905eddbe618ed6b575959505c73dd23fbce7e
File type: pdf · Size: 76905 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://speeddating.lt/speeddating/ckfinder/userfiles/files/razinejadaga.pdf - network signal, weight 0.70, confidence 0.80
Contacted 17 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://totalyoumovement.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c16bc96ebab---dikeb.pdf, http://www.zopfitravel.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607543043ae88---mazanuwela.pdf, http://quickvideo.nl/userfiles/file/93589215623.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9619 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787784963&P2=404&P3=2&P4=IPCb%2bAw5e%2f3Xhw5gNAXUnbsD1%2fXVnqmLuaCDGNkVdoSLtKMehMdnN%2fxjOVSkP5%2biyjGdE93hmPsN%2b%2f0wgYSX7g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787785039&P2=404&P3=2&P4=jnbyO6ZwZ8lIpzyv5B26jf7xVVpqafON9QgLv0b%2fia1T%2fXR%2fkRcrQMGt4i7n6DPhXyRVJsK1OH1K88tjB5zAdA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 45073bbc3167f2e5314c23e6529e0950e78b4014c7c559bd9d61a3b21daa775f
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\cc78c25d68c9c9953ac8fede4e3bcbb2.png - c6e64ec7ed4da21ea290a3a6b0b8f33951823d4d3e91ae2b3b7fe2c95a6cbf92
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/GLLx1DTH0VQ/uplcv?utm_term=free+residential+lease+agreement+texas+pdf
https://totalyoumovement.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c16bc96ebab---dikeb.pdf
http://www.zopfitravel.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607543043ae88---mazanuwela.pdf
http://quickvideo.nl/userfiles/file/93589215623.pdf
http://www.meglobalinc.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/16130d08e3efc2---bupatulaginuxodifo.pdf
http://www.gaviprintpack.com/wp-content/plugins/formcraft/file-upload/server/content/files/160802869cdc75---89190755947.pdf
https://geneolock.com/locktactyuma/userfiles/file/zoxokoxeboxizegurupegufe.pdf
http://firstcuwire.com/file_media/file_image/file/67342587053.pdf
https://speeddating.lt/speeddating/ckfinder/userfiles/files/razinejadaga.pdf
http://fslawoffice.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/gedopozax.pdf
http://www.theflightfest.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d99e40644b6---fesakezabomunoramaru.pdf
http://counterreaction.net/wp-content/plugins/formcraft/file-upload/server/content/files/16125fc55670b7---57130229745.pdf
https://whitelightdesign.com/wp-content/plugins/super-forms/uploads/php/files/526513278c4176d80f8f9630e06a4478/gebosefugitomupepev.pdf
http://ridendo.cz/files/file/65361726306.pdf
http://saokienviet.com/uploads/image/files/fasigosavikamorimupu.pdf
http://volker-issmer.de/userfiles/file/pomidasasa.pdf
http://netdepphunu.vn/images/userfiles/file/59018569934.pdf
https://kalatranslation.co.uk/wp-content/plugins/super-forms/uploads/php/files/dibabhuaumaltt4bqdo6o993i3/kutajuxemexa.pdf
http://www.nisbd.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a3565a19e0d---29706157527.pdf
http://china-engine.net/ckfinder/userfiles/files/zaketimitunufuzejuvogixu.pdf
https://www.quatainvestimentos.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1607ead438b9b4---sitat.pdf
http://ebslang.net/_UploadFile/Images/file/lusojigesesevafawugite.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/

Embedded domains

feedproxy.google.com
totalyoumovement.com
www.zopfitravel.com
quickvideo.nl
www.meglobalinc.co.za
www.gaviprintpack.com
geneolock.com
firstcuwire.com
fslawoffice.com
www.theflightfest.com
counterreaction.net
whitelightdesign.com
saokienviet.com
volker-issmer.de
kalatranslation.co.uk
www.nisbd.com
china-engine.net
www.quatainvestimentos.com.br
ebslang.net
www.w3.org
purl.org
ns.adobe.com
speeddating.lt
ridendo.cz
netdepphunu.vn

Embedded IP addresses

172.66.2.5
85.210.196.11
4.247.188.233
172.215.188.225
52.110.12.50
4.230.171.124
135.232.92.137
74.179.77.164
40.99.133.242
52.123.129.14
52.123.252.218
203.26.79.13
92.223.78.30
142.251.222.227
20.50.73.15
48.192.143.121
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report