MALICIOUS — b4d8a2dcd1ae8e522a526fdd24f36e042559240a18d72edd42c59bf20efc0020

MALICIOUS — b4d8a2dcd1ae8e522a526fdd24f36e042559240a18d72edd42c59bf20efc0020 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: b4d8a2dcd1ae8e522a526fdd24f36e042559240a18d72edd42c59bf20efc0020
SHA-1: 606cc581674c65495ecdbbdd6136838b50dd719a
MD5: dac67cc6f4cd2f7974d7286faa880496
ssdeep: 1536:c6hxN0UzoSGKaO/jcqpGmECunVWCpOVi9ZTW38Av5ZHsMJLTg:p0UX3wsECciViL6rO
TLSH: T11337C0F721E7ED8C374ADB432DAB129D6089E3957262EA50804CB36C84BC9BE7F40051
Submitted as: b4d8a2dcd1ae8e522a526fdd24f36e042559240a18d72edd42c59bf20efc0020
File type: pdf · Size: 76486 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://innova-perila.ru/upload/files/mapagemilodovedame.pdf - network signal, weight 0.70, confidence 0.80
Contacted 21 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://coretry.ru/uplcv?utm_term=pdf+to+ebook+converter+app, http://innova-perila.ru/upload/files/mapagemilodovedame.pdf, https://pnvvr.ro/userfiles/file/pivogupuxijaseki.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9672 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
_dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\231b210c46dc8f5628a338548a63f2c8.png - 0558176dd3612f6247a115820f7e47f62fbfbc4f5a79ae04c37cf18be2c2c626
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 546e43e8682dab168caae083ff8708199ca5c494a4316c5e5b754074f4cf6769
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://coretry.ru/uplcv?utm_term=pdf+to+ebook+converter+app
http://innova-perila.ru/upload/files/mapagemilodovedame.pdf
https://pnvvr.ro/userfiles/file/pivogupuxijaseki.pdf
http://www.sunarsurdurulebilir.com/wp-content/plugins/super-forms/uploads/php/files/sqs8o1dk7ucu0jmi7ipqbv2de1/xaxinetazigek.pdf
http://cascad-trans.ru/files/88777112120.pdf
http://www.alcera.ca/userfiles/file/35260643648.pdf
https://netiko.fr/img/Data/file/gireboxepusogum.pdf
http://speckrepej.com/upload/file/rixedo.pdf
http://yuc-fac.com/uploadfiles/20210915150416.pdf
https://aguiapromocional.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1613996ad36dfd---14118739206.pdf
https://atiksigorta.com/files/28685933688.pdf
http://31kouqiang.com/userfiles/file/1631392582.pdf
http://pskov.agisinfo.ru/uploads/content/files/tofituf.pdf
http://kxqcgs.net/filespath/files/20210908161804.pdf
http://traktorpulling.de/ablage/userfiles/files/24940967081.pdf
http://worshipedia.net/sites/default/files/file/lofibomazivuti.pdf
http://dolphinkorea.com/files/files/41829081425.pdf
https://lifo-sea.com/ckfinder/userfiles/files/89824828813.pdf
http://miamiwars.pl/wp-content/plugins/super-forms/uploads/php/files/9eb0511d07677dd2ecaf55cd3ec6afc6/nafabafiwurawudusuk.pdf
https://goldengrowers.com/wp-content/plugins/super-forms/uploads/php/files/c64c69330a112dcdac5b6578d21e36eb/86936851363.pdf
http://dlzhrjd.com/images/uploadfile/files/xitupadimijeme.pdf
http://mamnonsaokhue.vn/app/webroot/files/ckfinder/files/dilivuditafexutu.pdf
http://lamarchesainterita.be/lamarchesainterita/imgdb/news/files/84575494942.pdf
http://foodzipo.com/uploads/userfiles/files/22755161706.pdf
https://montpellier-business-plan.com/mbp/upload/images/images/upload/ckfinder/tubiporuwi.pdf

Embedded domains

coretry.ru
innova-perila.ru
www.sunarsurdurulebilir.com
cascad-trans.ru
www.alcera.ca
netiko.fr
speckrepej.com
yuc-fac.com
aguiapromocional.com.br
atiksigorta.com
31kouqiang.com
pskov.agisinfo.ru
kxqcgs.net
traktorpulling.de
worshipedia.net
dolphinkorea.com
lifo-sea.com
miamiwars.pl
goldengrowers.com
dlzhrjd.com
lamarchesainterita.be
foodzipo.com
montpellier-business-plan.com
dazhonghua1688.com
www.w3.org

Embedded IP addresses

104.156.58.56
40.84.97.4
51.11.192.48
135.232.92.137
40.79.141.155
52.110.12.21
52.110.12.56
4.230.171.124
57.155.104.224
4.150.223.105
20.76.201.171
40.103.64.226
52.123.128.14
135.233.45.221
135.232.92.34
72.154.7.113
203.26.79.13
52.123.252.240
92.223.78.30
20.42.73.30
4.150.223.100
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report