MALICIOUS — loxofuda.pdf

MALICIOUS — loxofuda.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 50 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: b65dcf3ca91cc98383ab3276d957453c3454cb47250c12ec4c6251d3a7bdfeab
SHA-1: 3cd4c2d0027421570d8acfefb19eeb636e1b9ae9
MD5: 9ae6deb9237d1b71519ccada9ca1236a
ssdeep: 1536:HvhNyvQw59OBtaY9N3cHBbNfyuK3QyuWapOtQHWgfc2kTt8znJkcXiQThjKZcgC:S9OfaVBbNfyD3rtQwNTt8zJkcSQT0fC
TLSH: T1F739D0F320A7CD4C3B9B8F4778A61299B08AD2C47222DF604588762CD67C5BDBF01A51
Submitted as: loxofuda.pdf
File type: pdf · Size: 89187 bytes
Verdict: malicious (99/100)

Detections (4 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
Emsisoft (Emergency Kit): PDF.Spam.Heur.1

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Lazarus): root_.cache_dconf_user - dynamic signal, weight 0.80, confidence 0.90
Contacted 22 external host(s) at runtime (3 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://asesorialuishervas.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613493cfa3591---40825803829.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: http://www.sainteuphrasia.com/www/js/ckfinder/userfiles/files/dirivotamisodabi.pdf, http://challendor.com/fckeditor/upload/file/tutigunugipusifolok.pdf, https://graveyards-fuj.ae/userfiles/files/86841146272.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9813 behavior events · 1 ATT&CK techniques · 4 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
searchapp.bundleassets.example
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
desktop-hsgcbep
250.255.255.239.in-addr.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
23.40.52.209
23.11.37.157
20.190.167.150

Dropped files

/opt/CAPEv2/storage/analyses/24643/files/b577c2fe814e663ac8a5d36abacd203f7c53885ec90fa3701dfde4667e69c2f5 - b577c2fe814e663ac8a5d36abacd203f7c53885ec90fa3701dfde4667e69c2f5
/opt/CAPEv2/storage/analyses/24643/files/1bea5eb20df7db031191f7e635a79e12a5318169ae45ae13b1c84152a79cfcf7 - 1bea5eb20df7db031191f7e635a79e12a5318169ae45ae13b1c84152a79cfcf7
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
tmp_tmp.ny3kAb2Jub - 93e90b365c33532ada40f281dd2e88f485b0cf2958701cf17dd7b057a699abc4

Embedded URLs

https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/Om9ozkHLxGw/uplcv?utm_term=marathi+e+novels+free+download
http://www.sainteuphrasia.com/www/js/ckfinder/userfiles/files/dirivotamisodabi.pdf
http://challendor.com/fckeditor/upload/file/tutigunugipusifolok.pdf
https://graveyards-fuj.ae/userfiles/files/86841146272.pdf
http://asesorialuishervas.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613493cfa3591---40825803829.pdf
http://dichvu12h.net/userfiles/file/62413710757.pdf
http://aid-calais.com/userfiles/file/bofufopabugarep.pdf
http://piqiso.ru/userfiles/file/27600431451.pdf
http://springgalleryng.com/Images_upload/files/joliribugamexutod.pdf
http://kursverwaltung.fit-n-essen.ch/ckfinder/userfiles/files/32417031507.pdf
https://orkhaconstruction.com/wp-content/plugins/super-forms/uploads/php/files/uproesk0qfrm2bmkhq8rqk3cr1/jomituzewa.pdf
https://magiccat.pro/ckfinder/userfiles/files/bufirisivu.pdf
https://elemonbg.com/Files/File/10604277866.pdf
https://privatecambodiatour.com/userfiles/file/89502512814.pdf
http://cee1968.com/ckfinder/userfiles/files/28627300843.pdf
http://sergeisurzhin.ru/ckfinder/userfiles/files/29737785089.pdf
https://penzion-pod-rozhlednou.cz/img/file/21403754166.pdf
http://www.verneteco.com/ckfinder/userfiles/files/tefakepip.pdf
http://chapelguild.com/images/usr/xedivubi.pdf
http://lightofislamonair.org/uploads/files/16928104165.pdf
http://asacnfservices.com/ckfinder/userfiles/files/naxapezasovixutoroxo.pdf
https://pjkconstruction.ca/images/file/69175311450.pdf
https://icnj.net/ckeditor/ckfinder/userfiles/files/mubuzuxidetutixipun.pdf
http://kleinschaden-expert.de/userfiles/file/56587418356.pdf
http://nature-revive.org/files/file/luvujarugaze.pdf

Embedded domains

feedproxy.google.com
www.sainteuphrasia.com
challendor.com
asesorialuishervas.com
dichvu12h.net
aid-calais.com
piqiso.ru
springgalleryng.com
kursverwaltung.fit-n-essen.ch
orkhaconstruction.com
magiccat.pro
elemonbg.com
privatecambodiatour.com
cee1968.com
sergeisurzhin.ru
www.verneteco.com
chapelguild.com
lightofislamonair.org
asacnfservices.com
pjkconstruction.ca
icnj.net
kleinschaden-expert.de
nature-revive.org
yanartextil.com
www.w3.org

Embedded IP addresses

20.184.175.9
74.178.240.61
85.210.196.11
52.230.59.222
4.230.171.124
74.178.76.44
20.42.179.192
52.123.129.14
162.159.36.2
203.26.79.13

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report