MALICIOUS — b466bb61f335a53a0370e48a9a76fb243f9256d0dd492ef0240907610a46d7dd

MALICIOUS — b466bb61f335a53a0370e48a9a76fb243f9256d0dd492ef0240907610a46d7dd is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: b466bb61f335a53a0370e48a9a76fb243f9256d0dd492ef0240907610a46d7dd
SHA-1: 1dbcbef7731b97f898fb25a6d41eeb133b49f937
MD5: 96a62253411b36141a52b3825accd8e1
ssdeep: 1536:PiRPaHgppCTmYEvnMMltQ1Djw1rpgV6m+W6pOu26WHTZCfbY5dnwq:KQ1T2vnRltQ1DjXVT7u2pY83B
TLSH: T19E38CFF320ABDD9CB749DF03196E11B96446C7892212EB1050C8BB6CD8BC6BD7E24761
Submitted as: b466bb61f335a53a0370e48a9a76fb243f9256d0dd492ef0240907610a46d7dd
File type: pdf · Size: 82936 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://joyear.com/ckfinder/userfiles/files/nonolosizidan.pdf - network signal, weight 0.70, confidence 0.80
Contacted 25 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://sipare.com.ar/wp-content/plugins/super-forms/uploads/php/files/8sr14d70q32944ns2fr32snv5h/sopunadani.pdf, http://joyear.com/ckfinder/userfiles/files/nonolosizidan.pdf, http://e-sportis.com/images/upload/dewevupubaxoj.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9643 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
desktop-hsgcbep
255.255.254.169.in-addr.arpa
251.0.0.224.in-addr.arpa
79.243.254.169.in-addr.arpa

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - e293cdd121e0f6ebe769045f4fc62f4aa6df5e33e11c43bbb6c5c30028e142c9
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\5939cc94ede17c1f43d8cf9e69a80c10.png - 3f8f906c88af3e91fc5412ed80f8d5274f85332111f509703a1306e2a7ec5947
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/S30rS-6n6vg/uplcv?utm_term=what+is+meaning+enclosed+space
https://sipare.com.ar/wp-content/plugins/super-forms/uploads/php/files/8sr14d70q32944ns2fr32snv5h/sopunadani.pdf
http://joyear.com/ckfinder/userfiles/files/nonolosizidan.pdf
http://e-sportis.com/images/upload/dewevupubaxoj.pdf
https://magiccat.pro/ckfinder/userfiles/files/35758093036.pdf
http://www.nuricomuvakfi.org/wp-content/plugins/super-forms/uploads/php/files/32lbf7tn6o93mja3i352rjt9d0/mezufaduvaxabaj.pdf
http://objetivovender.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c815362ea3---61031268356.pdf
https://www.isnb.co.uk/wp-content/plugins/super-forms/uploads/php/files/73576525260191d2d28f1cffd079e6d1/nufopoguru.pdf
https://www.entornopublicitario.com/wp-content/plugins/super-forms/uploads/php/files/4366fd1d268a6180b4fd09a68e4ab6a2/27246570986.pdf
http://osheamaloneynylaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/mubaporixuzolujap.pdf
http://www.catalogodecineargentino.com/wp-content/plugins/formcraft/file-upload/server/content/files/161114fbd34139---tufazapuzakivovonip.pdf
https://georgiamusicpartners.org/wp-content/plugins/super-forms/uploads/php/files/09ae3e9c7a1896aa107d72d464961e32/55955230944.pdf
http://marthomaiticherukole.com/userfiles/file/mafegifoponika.pdf
https://www.taxiserviceh24.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607e66a68683b---84444558405.pdf
https://www.oneirishrover.com/wp-content/plugins/super-forms/uploads/php/files/b1a6d903e40e2f080762efc1c991812b/newugib.pdf
https://sitebyside.ru/wp-content/plugins/super-forms/uploads/php/files/41f83f01104e890feb7b1c0a0dc5798b/27680564744.pdf
http://dansecyr.ca/pdf/file/jakesubada.pdf
https://theemperorsoldclothes.co.uk/wp-content/plugins/super-forms/uploads/php/files/5co2ifcdbkg3ldrq79ggfnuki3/zalesijije.pdf
https://ahi.com.ua/wp-content/plugins/super-forms/uploads/php/files/933f6162630422c2646aa09c977ff567/repizuvosapuviw.pdf
http://socialbomjesus.org.br/wp-content/plugins/formcraft/file-upload/server/content/files/160872a9a199b0---81989233596.pdf
http://conblocmanado.com/pics/file/43449048858.pdf
http://driver-jazda.pl/upload/file/46526170879.pdf
http://zhodnoceni-penez.cz/is/images/FCKeditor/File/susofukafenerazosijosed.pdf
http://www.marcelasemper.com/wp-content/plugins/formcraft/file-upload/server/content/files/160f71e023eb75---zekigisowaleduden.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

feedproxy.google.com
joyear.com
e-sportis.com
magiccat.pro
www.nuricomuvakfi.org
objetivovender.com
www.isnb.co.uk
www.entornopublicitario.com
osheamaloneynylaw.com
www.catalogodecineargentino.com
georgiamusicpartners.org
marthomaiticherukole.com
www.taxiserviceh24.com
www.oneirishrover.com
sitebyside.ru
dansecyr.ca
theemperorsoldclothes.co.uk
ahi.com.ua
socialbomjesus.org.br
conblocmanado.com
driver-jazda.pl
www.marcelasemper.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

92.223.78.30
20.165.94.46
72.154.7.104
4.247.188.233
52.168.112.66
135.233.95.144
172.66.2.5
52.168.117.171
40.84.85.40
4.230.171.124
52.230.59.222
20.247.184.142
74.178.240.51
20.76.201.171
52.123.129.14
20.50.73.14
13.71.177.232
52.123.252.219
52.123.252.226
72.145.35.109
203.26.79.13
52.123.252.227
142.251.42.99
57.155.101.212
172.178.240.162

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report