MALICIOUS — b80965bca848388eb0a25465795790d1ea3c9bca77cf62fa61a70a1d813b398a

MALICIOUS — b80965bca848388eb0a25465795790d1ea3c9bca77cf62fa61a70a1d813b398a is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: b80965bca848388eb0a25465795790d1ea3c9bca77cf62fa61a70a1d813b398a
SHA-1: 5e50b869f3d8e5572a73a9d20555a0e8b2f041e2
MD5: 9864758355f1cb423e65b452924875f5
ssdeep: 1536:UCEmWK0Qe93rDn4GEhNDJQ5AqYXKVAb2oPuW6g0FP/QZnCFWcpOmy7Q:f8KKDn4G6NdLqYX32ocxFPIBC8mp
TLSH: T1DB38CFF35197DE5CB38B9F4369EB105C6185D7CD2622DFA08088A77CC578ABCBA20911
Submitted as: b80965bca848388eb0a25465795790d1ea3c9bca77cf62fa61a70a1d813b398a
File type: pdf · Size: 81591 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://chiangmai-esc.net/user_img/files/86435759858.pdf - network signal, weight 0.70, confidence 0.80
Contacted 11 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://chiangmai-esc.net/user_img/files/86435759858.pdf, https://ozora.schaffsen.com/contents/file/najugodovog.pdf, http://sinostandards.net/upload/files/xezasuxenemoto.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9642 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 67e10a5c4c367a92f5df503d1d51f6493d93e12fc6e0bc6a6f77f7ddd00c85b4
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\b126374d304bdd7f71b5876667178e95.png - cbc36f78a4bbe92df008b204f1a6d920d8412b1358813fdc48ceb253fd4684a4
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/BvfzZFkJO3s/uplcv?utm_term=ihd+with+pci
http://chiangmai-esc.net/user_img/files/86435759858.pdf
https://ozora.schaffsen.com/contents/file/najugodovog.pdf
http://sinostandards.net/upload/files/xezasuxenemoto.pdf
https://n95america.com/wp-content/plugins/super-forms/uploads/php/files/447bb1ef69586faa8448d2ae687be578/midabasetuwubavibolot.pdf
http://urduhadith.org/survey/userfiles/files/58522567800.pdf
http://sky1981.com/asset/uploads/files/ziwonofoxomafutal.pdf
http://www.tobywells.org/media/fckdir/file/14873155179.pdf
http://haustechnik-hagenauer.at/60532370687.pdf
http://test.uebersetzungen-nesselberger.de/wp-content/plugins/formcraft/file-upload/server/content/files/1613b325a0d673---92502334807.pdf
http://bangtaisay.com/uploads/userfiles/file/vokopamuxivinumi.pdf
http://bckvalumni.org/userfiles/file/93044008138.pdf
https://hiperaktivite.info/userfiles/files/20737374150.pdf
https://cosmetic.dilen.top/upload/files/tuxutisedatosivanit.pdf
http://acupunctuuryao.nl/ckfinder/userfiles/files/lopovasuzamudugipukax.pdf
http://lovepetclinics.com/file_media/file_image/file/78884840150.pdf
http://la-roofers.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/161315e2a33bc9---56640317154.pdf
https://organicearthfiji.com/documents/file/vojipale.pdf
http://thietbibepnhahang.net/media/files/87127990738.pdf
http://szsahsh.com/uploads/files/koxufatosibejovubalazanej.pdf
https://beaufortbond.com/wp-content/plugins/super-forms/uploads/php/files/338d08959dcadd8859fdc42ecaa3581f/1772402544.pdf
http://rc-saty.cz/gais/image/file/wituvex.pdf
http://mcutech.net/files/54760379769.pdf
https://dom4m.de/userfiles/files/33397721607.pdf
http://thepokeluau.com/uploads/files/wufelim.pdf

Embedded domains

c.uk
feedproxy.google.com
chiangmai-esc.net
ozora.schaffsen.com
sinostandards.net
n95america.com
urduhadith.org
sky1981.com
www.tobywells.org
test.uebersetzungen-nesselberger.de
bangtaisay.com
bckvalumni.org
hiperaktivite.info
cosmetic.dilen.top
acupunctuuryao.nl
lovepetclinics.com
la-roofers.co.uk
organicearthfiji.com
thietbibepnhahang.net
szsahsh.com
beaufortbond.com
mcutech.net
dom4m.de
thepokeluau.com
www.w3.org

Embedded IP addresses

4.230.171.124
4.247.188.224
74.179.77.164
20.231.239.246
40.99.133.242
52.123.128.14
52.123.252.224
135.233.45.223
203.26.79.13
52.123.252.231
92.223.78.30

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report