MALICIOUS — b3bd3628cdc3ccbee73cae745a6516a8f0f985ca959e485f191efc11acf207ca

MALICIOUS — b3bd3628cdc3ccbee73cae745a6516a8f0f985ca959e485f191efc11acf207ca is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 54 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: b3bd3628cdc3ccbee73cae745a6516a8f0f985ca959e485f191efc11acf207ca
SHA-1: faca5bddd920ae579a7f6fd6aa1495f9292b419d
MD5: 45f7c650cad2d1345ddb9086b88405da
ssdeep: 1536:J3bRdRWSyIWmVQUNw/cdYMsUt57YdpEFnOSJwW8WGV45sdvwWQpOCMSTnrvo:VbFxylbUukdYMsUt5sdpunfGPdvfC3TE
TLSH: T18339D0F7219BDE5C774A8B0365EB01D8609DE3082161EA90118C7A7CE9BC6FCBE14721
Submitted as: b3bd3628cdc3ccbee73cae745a6516a8f0f985ca959e485f191efc11acf207ca
File type: pdf · Size: 85443 bytes
Verdict: malicious (99/100)

Detections (4 of 54 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://kxzyjy.com/CKEdit/upload/files/85892605347.pdf - network signal, weight 0.70, confidence 0.80
Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://smidgel.ru/uplcv?utm_term=data+in+file+is+corrupt+and+needs+to+be+manually+recovered, http://guerrazzi.info/userfiles/files/465438625.pdf, https://www.dyna-tech.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1615814c07d7de---resinomitoboziwasug.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Contacted 9 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

1011 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
23.40.52.209
23.11.37.157
20.190.142.163
150.171.22.17
23.33.238.178
52.110.12.1 US · AS8075 MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US
4.230.171.124 KR · Seoul · AS8075 Microsoft Corporation
48.211.4.16 US · Ashburn · AS8075 Microsoft Limited
23.33.238.114
52.253.84.76 SG · Singapore · AS8075 Microsoft Corporation
135.232.92.97 US · Boydton · AS8075 Microsoft Limited
4.150.223.104 US · Des Moines · AS8075 Microsoft Corporation

Dropped files

root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://smidgel.ru/uplcv?utm_term=data+in+file+is+corrupt+and+needs+to+be+manually+recovered
http://guerrazzi.info/userfiles/files/465438625.pdf
https://www.dyna-tech.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1615814c07d7de---resinomitoboziwasug.pdf
http://grandfiltr.com/files/file/bupepowafimu.pdf
https://www.cir.cloud/wp-content/plugins/formcraft/file-upload/server/content/files/16130acde31fb2---72878383846.pdf
http://kxzyjy.com/CKEdit/upload/files/85892605347.pdf
https://gangnampools.com/contents/files/vijaxutenu.pdf
http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/161310857e6801---1588455193.pdf
http://wx-bm.cn/upload/ckimg/files/202110011633044912.pdf
http://saludocupacionalpso.com/home/wp-content/plugins/formcraft/file-upload/server/content/files/1615f03370a3ed---57314317221.pdf
http://7serve.org/userfiles/file/20210920230238.pdf
https://mrdak.cc/uploadfile/files/74182420486.pdf
https://www.gpaci.org.br/cms/ckfinder/userfiles/files/34470220464.pdf
http://ssteelelaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/fovixozivigapubiv.pdf
https://partnermind.cz/images/files/23719888877.pdf
https://chachachat.info/js/ckfinder/userfiles/files/1847359664.pdf
http://gelikonline.ru/content/Files/12534656760.pdf
http://sushinamu.com/uploads/files/69434453191.pdf
http://fqcycpa.com/jingkelun/userfiles/files/20211007070859.pdf
http://triatlonbizuterie.cz/sites/default/files/file/19563255353.pdf
http://northmarking.com/userfiles/files/80906547819.pdf
http://teifsepahan.com/files/file/jowejoruwigidugojekapo.pdf
https://www.bouldersudbury.org/wp-content/plugins/formcraft/file-upload/server/content/files/1612f4d5dbafe3---64208209741.pdf
http://centralcogtc.com/uploads/file/tiwiraxomevojuvizudebu.pdf
http://styrexon.cz/userfiles/file/85642287470.pdf

Embedded domains

smidgel.ru
guerrazzi.info
www.dyna-tech.nl
grandfiltr.com
www.cir.cloud
kxzyjy.com
gangnampools.com
www.1000ena.com
wx-bm.cn
saludocupacionalpso.com
7serve.org
mrdak.cc
www.gpaci.org.br
ssteelelaw.com
chachachat.info
gelikonline.ru
sushinamu.com
fqcycpa.com
northmarking.com
teifsepahan.com
www.bouldersudbury.org
centralcogtc.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

85.210.196.11
74.178.76.44
52.110.12.1
4.230.171.124
48.211.4.16
52.253.84.76
135.232.92.97
4.150.223.104
20.184.175.15

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report