MALICIOUS — b880b1592ba3b5d847261ebbe2825a4fe3732c28beee3684a2ac0eef290d2d57

MALICIOUS — b880b1592ba3b5d847261ebbe2825a4fe3732c28beee3684a2ac0eef290d2d57 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: b880b1592ba3b5d847261ebbe2825a4fe3732c28beee3684a2ac0eef290d2d57
SHA-1: 4d5b58f8899aef8d8f07764922bfd9787eca8a22
MD5: c4ff7ef986d3f29a65953fdf8cfe3a50
ssdeep: 1536:3cALpPc/polw2OTqjuTZk8eJv1oHpWWqO3LjQ+xWOpOaZdaeCRD:n+/polwd2Z51oTn3qaZ5c
TLSH: T1C037D0FB6197DD9CB74B5B0318BA13687449E38C6162EBA00088776C99BC5BEBF40650
Submitted as: b880b1592ba3b5d847261ebbe2825a4fe3732c28beee3684a2ac0eef290d2d57
File type: pdf · Size: 75185 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://www.kiemtoandongnghi.com/public/plugins/ckfinder/userfiles/files/53700982555.pdf - network signal, weight 0.70, confidence 0.80
Contacted 14 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://infrive.ru/uplcv?utm_term=the+best+loadout+in+modern+warfare, https://restavracia02.com/userfiles/file/44620968949.pdf, https://n-tlg.com/files/file/nojamazegamefisopigel.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9655 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - c820167cdce7a24d4293932904be1095755e83d531587104cbf57d02a41b90c2
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\ace3bbfbd48ee5cdc0807c379fd4572e.png - 87e71c5d790cb98a9d6890473780a377c615c168a58d259c40f557b49a83a89d
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://infrive.ru/uplcv?utm_term=the+best+loadout+in+modern+warfare
https://restavracia02.com/userfiles/file/44620968949.pdf
https://n-tlg.com/files/file/nojamazegamefisopigel.pdf
https://clove7.com/userfiles/file/tarojo.pdf
https://www.kiemtoandongnghi.com/public/plugins/ckfinder/userfiles/files/53700982555.pdf
http://media-production.net/admin/ckfinder/userfiles/files/woxozewuvudu.pdf
http://myphamnanyno.com/luutru/files/punupabagaledoxedoweduped.pdf
https://controlcert.se/wp-content/plugins/formcraft/file-upload/server/content/files/16130a1d3f30ac---naxumetusijazu.pdf
https://windscrm.net/files/file/70469702387.pdf
http://msnladyboy.com/ckfinder/userfiles/files/21191660720.pdf
http://krr-nfe.com/suratnfe/UserFiles/File/bedesuvabunibopaxiwuduta.pdf
https://abzesolar.com/uploads/files/33699394306.pdf
http://aromacosmetics.bg/assets/userfiles/file/fabadolimususumeninupe.pdf
http://gingerwooddesign.com/wp-content/plugins/formcraft/file-upload/server/content/files/161386d52643f3---82670314936.pdf
https://cncostruzioni.com/userfiles/file/10023731919.pdf
http://transporteslaplata.com/imagenes_web/file/xafudemijazefavun.pdf
http://tutaylamhet.com/storage/ckfinder/files/40023360471.pdf
https://thaiwoodengames.com/files/upload/files/kufujibigavolezizago.pdf
https://taiwan-tiaya.com/upload/tiaya_official/files/26743024167.pdf
http://taxfreepoint.com/file/rapodixevu.pdf
https://flcevent.fcu.edu.tw/plugin/ce1/ckfinder/userfiles/files/20210904203256.pdf
http://afro-safari.com/upload/files/pijesigidid.pdf
http://recruiters-zone.com/wp-content/plugins/formcraft/file-upload/server/content/files/161351dc43b2c4---roguridez.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/

Embedded domains

infrive.ru
restavracia02.com
n-tlg.com
clove7.com
www.kiemtoandongnghi.com
media-production.net
myphamnanyno.com
controlcert.se
windscrm.net
msnladyboy.com
krr-nfe.com
abzesolar.com
gingerwooddesign.com
cncostruzioni.com
transporteslaplata.com
tutaylamhet.com
thaiwoodengames.com
taiwan-tiaya.com
taxfreepoint.com
flcevent.fcu.edu.tw
afro-safari.com
recruiters-zone.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

40.79.167.9
85.210.193.152
4.230.171.124
135.232.92.34
203.26.79.13
4.207.44.77
74.178.240.61
52.123.128.14
52.123.129.14
135.233.45.222
52.168.117.174
172.175.111.170
52.178.17.2
4.150.223.105

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report