MALICIOUS — b5589dbbd23ebe7f3ab304525565193f71c3496ab8b0ac2ec27921ddff353735

MALICIOUS — b5589dbbd23ebe7f3ab304525565193f71c3496ab8b0ac2ec27921ddff353735 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: b5589dbbd23ebe7f3ab304525565193f71c3496ab8b0ac2ec27921ddff353735
SHA-1: 5e23a1d90045c4c5be2e9a5b6922a09d94d02df9
MD5: 187ef8436c5b8978893897e54c1aa7c5
ssdeep: 1536:QEu8B+8X2qJSDsvrV6OUyGaHL2NugSGWZzhMgaHWqQJp7pY/:fuHEVp9lHf9yHWqC7K
TLSH: T19437CFF36157CD8C76436F436AFA0265709EC249F132EAA428C87B2D99AC1ED3F10851
Submitted as: b5589dbbd23ebe7f3ab304525565193f71c3496ab8b0ac2ec27921ddff353735
File type: pdf · Size: 73362 bytes
Verdict: malicious (98/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!187EF8436C5B
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4420438/normal_6000537e44b07.pdf - network signal, weight 0.70, confidence 0.80
Contacted 18 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://queure.ru/pbw?utm_term=pokemon+emerald+rom+v+1.0+usa, https://static.s123-cdn-static.com/uploads/4420438/normal_6000537e44b07.pdf, http://nilanom.pbworks.com/f/62152078654.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9688 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 2e1cfdc4c1d9d65a94c4649168f30dbce94e6c11ad844e39210e5718826def6a
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\7dd900cd455da670b89740973a82a01f.png - 08be38be05bcc78d597dde105fa5d768aa10ed0a326e3eee081debe8fd2ba170
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://queure.ru/pbw?utm_term=pokemon+emerald+rom+v+1.0+usa
https://static.s123-cdn-static.com/uploads/4420438/normal_6000537e44b07.pdf
http://nilanom.pbworks.com/f/62152078654.pdf
https://cdn-cms.f-static.net/uploads/4366982/normal_5fea1c93ef13d.pdf
http://numefen.pbworks.com/w/file/fetch/144633672/australian_visa_application_form_956.pdf
https://cdn-cms.f-static.net/uploads/4416787/normal_5fe7a8cf11ffa.pdf
http://tefimemovem.pbworks.com/w/file/fetch/144760713/99092756319.pdf
https://uploads.strikinglycdn.com/files/963cffff-f03f-4077-aedf-1123e59294ac/98962062342.pdf
https://cdn-cms.f-static.net/uploads/4447631/normal_60218b11282de.pdf
http://pafunanukexe.pbworks.com/w/file/fetch/144522957/lixebutigafor.pdf
http://kedetuwi.pbworks.com/f/5942055893.pdf
https://static.s123-cdn-static.com/uploads/4417207/normal_5fee37c7d271b.pdf
https://static.s123-cdn-static.com/uploads/4415051/normal_5ff7e2a51f583.pdf
https://static.s123-cdn-static.com/uploads/4418184/normal_60004c3d1a619.pdf
https://uploads.strikinglycdn.com/files/c05715f8-1647-4500-a928-504d9adc7494/when_you_have_time_to_think_quotes.pdf
https://uploads.strikinglycdn.com/files/88cc259b-16f1-4e27-b4a3-a5f9c5d31ba1/92885069700.pdf
http://rerikisozid.pbworks.com/w/file/fetch/144639633/169542893.pdf
https://uploads.strikinglycdn.com/files/b6cd672d-283d-4e14-ab46-349009952ce3/99632789258.pdf
https://cdn-cms.f-static.net/uploads/4383137/normal_602155d2404db.pdf
https://uploads.strikinglycdn.com/files/d77d28d6-e2fc-4643-b603-79612fbcc4ef/lulixulokifumetudatote.pdf
https://static.s123-cdn-static-d.com/uploads/4477863/normal_60b3d116115ba.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/

Embedded domains

queure.ru
static.s123-cdn-static.com
nilanom.pbworks.com
cdn-cms.f-static.net
numefen.pbworks.com
tefimemovem.pbworks.com
uploads.strikinglycdn.com
pafunanukexe.pbworks.com
kedetuwi.pbworks.com
rerikisozid.pbworks.com
static.s123-cdn-static-d.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

135.233.95.80
52.230.59.222
40.84.85.40
52.110.12.48
4.230.171.124
74.179.77.204
20.42.65.84
20.231.239.246
52.123.129.14
72.145.35.104
203.26.79.13
52.123.252.245
74.179.71.159
172.215.188.232
13.89.179.12
4.150.223.107
20.184.175.19
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report