MALICIOUS — b7408acd897a12abdbeaf742dc0771669076ce5eebdf6e54c99b008161033b2b

MALICIOUS — b7408acd897a12abdbeaf742dc0771669076ce5eebdf6e54c99b008161033b2b is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: b7408acd897a12abdbeaf742dc0771669076ce5eebdf6e54c99b008161033b2b
SHA-1: 22d5b67cc679f362d1da2d77b8be8a7f7f5d66a7
MD5: 51931b7fbe8d4713b8cd234ee4a60529
ssdeep: 1536:eWEN9//u28hNmUYUUp6eicM7B6GQralaaOiQdmpKWUpO7qWDy2Ycp0u:TEN9Xp8hKUS6einBBe1abQwpl7ldT
TLSH: T13339C0F36193DD8CB68B8F075AE7165974C9EB996132EB900488B73C85BC6BC7B00611
Submitted as: b7408acd897a12abdbeaf742dc0771669076ce5eebdf6e54c99b008161033b2b
File type: pdf · Size: 84395 bytes
Verdict: malicious (99/100)

Detections (4 of 54 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 10 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://nomylo.ru/uplcv?utm_term=pusher+mania+hack, http://gzcil.com/uploadfile/files/58781842973.pdf, https://www.hauptsache.cc/wp-content/plugins/formcraft/file-upload/server/content/files/16147310b1f804---30804407793.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 5 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in Acrobat.exe (pid 9056) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

1004 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
c.pki.goog
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
desktop-hsgcbep._dosvc._tcp.local
desktop-hsgcbep(1)._dosvc._tcp.local
desktop-hsgcbep(2)._dosvc._tcp.local
desktop-hsgcbep(3)._dosvc._tcp.local
desktop-hsgcbep(4)._dosvc._tcp.local
desktop-hsgcbep(5)._dosvc._tcp.local
desktop-hsgcbep(6)._dosvc._tcp.local
desktop-hsgcbep(7)._dosvc._tcp.local
ntp.ubuntu.com
_dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://nomylo.ru/uplcv?utm_term=pusher+mania+hack
http://gzcil.com/uploadfile/files/58781842973.pdf
https://www.hauptsache.cc/wp-content/plugins/formcraft/file-upload/server/content/files/16147310b1f804---30804407793.pdf
http://sanxuatbanthinghiem.org/app/webroot/uploads/files/1293400408.pdf
https://patoman.ro/ckfinder/userfiles/files/2087885995.pdf
https://beautyyaurient.com/editor_upload/file/nonexaxedesomatojiwor.pdf
http://utpcomp.ru/uploads/files/lekodasetisewelaxavoz.pdf
https://umartravel.com/files/36511150615.pdf
https://fontan-montag.ru/img/upload/bulamebogazi.pdf
http://yuhao-tech.com/userfiles/file/vaxovuperaz.pdf
https://aitalk.vn/upload/files/32160626401.pdf
https://andymullinscommercial.com/home/andy/public_html/ckfinder/userfiles/files/robow.pdf
http://kioskcondoweb.wpengine.com/wp-content/plugins/formcraft/file-upload/server/content/files/16132d36116647---nusalexaj.pdf
http://synphabase.ch/upload/file/97787777870.pdf
http://commissioncollectionlaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/rakiverenufaj.pdf
http://cestovni-postylka.eu/userfiles/file/26629978775.pdf
https://hiroyoung.com/data/files/timoxilopa.pdf
http://lirealestatelitigator.com/wp-content/plugins/super-forms/uploads/php/files/11276c0b19724b9fa84af69690b391ea/69632323567.pdf
https://churchosonline.com/wp-content/plugins/super-forms/uploads/php/files/6774a9e85a8c7e8e90fda8625e006e70/gakinowaluto.pdf
http://transgusto.ch/userfiles/file/71592524850.pdf
http://irpuyesh.com/cache/fck_files/file/88653116779.pdf
https://vinatech.com/userfiles/file/poxebekiretuserabi.pdf
http://solo-reisen.com/media/images/file/rugasumawexojuvobi.pdf
http://morenoroofing.com/wp-content/plugins/formcraft/file-upload/server/content/files/16135b15ccb8b5---fepubumiwede.pdf
http://bigyikesmedia.com/home/xtremweb/public_html/consultinstitute/web/upload/files/27614341640.pdf

Embedded domains

nomylo.ru
gzcil.com
www.hauptsache.cc
sanxuatbanthinghiem.org
beautyyaurient.com
utpcomp.ru
umartravel.com
fontan-montag.ru
yuhao-tech.com
andymullinscommercial.com
kioskcondoweb.wpengine.com
synphabase.ch
commissioncollectionlaw.com
cestovni-postylka.eu
hiroyoung.com
lirealestatelitigator.com
churchosonline.com
transgusto.ch
irpuyesh.com
vinatech.com
solo-reisen.com
morenoroofing.com
bigyikesmedia.com
elosc.com
www.w3.org

Embedded IP addresses

40.84.85.40
57.155.101.212
4.207.44.68
72.145.35.96
4.247.188.233
4.230.171.124
20.247.185.124
4.150.223.113
13.89.179.15
135.232.92.137

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report