MALICIOUS — b3f2d385366314369a94afcec0063df1e0124840957d695fead104aee9cc3fde

MALICIOUS — b3f2d385366314369a94afcec0063df1e0124840957d695fead104aee9cc3fde is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: b3f2d385366314369a94afcec0063df1e0124840957d695fead104aee9cc3fde
SHA-1: e30409f89dafa1c06ce7a5e49ea50e0e82e506f0
MD5: 9f14ccb0ee8257b59d61afe8fe4c4db4
ssdeep: 1536:FL/m8k5i6NNMqXgO3scZJ6S4NwLMzVZPabzxWOpOwrKWdZP6JBALhfUaW67z5Gi:JmJ5i6sqXgOfZJ6S46MrPHwrHZiXA1NZ
TLSH: T1383ACFF72197CD9C369B9F036AEA6169704AAB4C6172EB9000C8763CD4BC5FD3B10961
Submitted as: b3f2d385366314369a94afcec0063df1e0124840957d695fead104aee9cc3fde
File type: pdf · Size: 93889 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 22 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://www.physioaktivkramer.de/wp-content/plugins/formcraft/file-upload/server/content/files/16135d1daa508d---podakulazomazi.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://hopadive.cz/ckfinder/userfiles/files/84213932063.pdf, http://zussobrance.sk/grafika/dokumenty/4684653713.pdf, https://www.physioaktivkramer.de/wp-content/plugins/formcraft/file-upload/server/content/files/16135d1daa508d---podakulazomazi.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9756 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
_dosvc._tcp.local
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787912751&P2=404&P3=2&P4=T9XZbl85lvbQuNLO3VEbxdlXR0KrbP6RiWy%2bChbeKbJ%2f%2fyCHL83hCAjDeSDZkDiClxEsT0K0AaC5WBsmsU4fww%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787912782&P2=404&P3=2&P4=glrww2si284P1GvuHHBFkagdQqeSFljmauDzXGH2kijrGG7vO%2fbQh6y2Ck9IuvDdGLqzAHs2LssGKvkMI2J8wA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\a27abe6ae20ed0ac9ae1938f075907eb.png - 3af8bac478961a2a2d827024d2c72757e1714107e41059d9bd1be8df7e88d4b0
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - f01cc6c439b4c0e0e518a8284a91b1eb85964e87552707a5fccf41f6d258be6c
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/YTWXjIUwRh0/uplcv?utm_term=nba+2k8+download+android
https://hopadive.cz/ckfinder/userfiles/files/84213932063.pdf
http://zussobrance.sk/grafika/dokumenty/4684653713.pdf
https://www.physioaktivkramer.de/wp-content/plugins/formcraft/file-upload/server/content/files/16135d1daa508d---podakulazomazi.pdf
http://pi-consulting.ch/download/28350422268.pdf
https://castilloexterior.es/ckfinder/userfiles/files/16978987093.pdf
http://ntouioc.ntou.edu.tw/ckfinder/userfiles/files/31539200957.pdf
http://tischlerei-schlusche.de/sites/default/files/file/batogiwoj.pdf
https://edusfera.pl/upload/file/bitalazalakerakuka.pdf
https://cargotavio.ru/files/file/jagozilu.pdf
https://ta-taiwan.com/app/webroot/userfiles/files/vugisafosojopepo.pdf
http://frederickfollows.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/16143c2e745f29---gutorimopaxiniwi.pdf
http://vuatoyen.com/uploads/userfiles/file/botufifiribax.pdf
http://zhouzhuank.com/v15/Upload/file/202199181666118.pdf
http://abwsalisbury.com/uploads/files/gokomiputumugamuxokenos.pdf
http://wronba.com/uploads/wysiwyg/file/5092145486.pdf
http://gernano.eu/gfx/userfiles/files/ziranufimeminafuzuji.pdf
https://ruh-center.ru/userfiles/file/zakeniridesitisumov.pdf
https://lesartsdansmonjardin.com/userfiles/file/20210902145254.pdf
http://www.espaciocultivarte.com/ckfinder/userfiles/files/mamibadaxa.pdf
http://veterinarioassociatopacinidallatorre.eu/userfiles/files/28991486988.pdf
https://profix.fr/ckfinder/userfiles/files/papozikinuvodix.pdf
https://wlao.on.ca/wp-content/plugins/super-forms/uploads/php/files/f2a450de4f5450b2b235b3f81bacf320/mupopezib.pdf
http://ckpak.com/fckeditor/userfiles/file/nobasebopaze.pdf
https://www.azulejositurry.com/wp-content/plugins/super-forms/uploads/php/files/t60n7f9ko7fsp49huh12aeskg0/poxerapaxunenovifigam.pdf

Embedded domains

feedproxy.google.com
www.physioaktivkramer.de
pi-consulting.ch
castilloexterior.es
ntouioc.ntou.edu.tw
tischlerei-schlusche.de
edusfera.pl
cargotavio.ru
ta-taiwan.com
frederickfollows.co.uk
vuatoyen.com
zhouzhuank.com
abwsalisbury.com
wronba.com
gernano.eu
ruh-center.ru
lesartsdansmonjardin.com
www.espaciocultivarte.com
veterinarioassociatopacinidallatorre.eu
profix.fr
wlao.on.ca
ckpak.com
www.azulejositurry.com
1yunnan.com
www.w3.org

Embedded IP addresses

203.26.79.13
20.42.179.192
4.150.223.96
4.150.223.101
52.123.252.220
172.66.2.5
20.247.184.142
4.230.171.124
40.84.85.40
135.232.92.97
40.79.150.121
74.179.77.204
51.132.193.105
52.123.129.14
40.103.64.242
135.234.160.245
51.116.246.104
92.223.78.30
20.184.175.2
48.200.63.27
20.42.73.31
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report