MALICIOUS — ba72d608d8e2e0f98dc7cdaf30030a9168c753c57d335ab77b13b943736bcf41

MALICIOUS — ba72d608d8e2e0f98dc7cdaf30030a9168c753c57d335ab77b13b943736bcf41 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: ba72d608d8e2e0f98dc7cdaf30030a9168c753c57d335ab77b13b943736bcf41
• SHA-1: d2d05ef873c4f0e6dead17ccfbdc4a4522bcd84d
• MD5: ea0801f29f05c0af464af1dbd4fe3b88
• ssdeep: 1536:fmYBnLbCjxBmu1zH/Dg6R5FB3t6Ne3NbQ3VKav+L7qaAkpTqznvX9o:9B6jx91zHbg6tJt6N65Gs4kpTqDv6
• TLSH: T14239D0F321DBDE0CBEA54B1399E63229958FC7846177966844887A3C85BC6FC3E20850
• Submitted as: ba72d608d8e2e0f98dc7cdaf30030a9168c753c57d335ab77b13b943736bcf41
• File type: pdf · Size: 88361 bytes
• Verdict: malicious (96/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!EA0801F29F05
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1105
• T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Contacted 17 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
• Embedded link rated suspicious by URL analysis: https://transpack-krumbach.de/_upload_bilder/_filemanager/file/31793625601.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: http://perles-del-beya.com/userfiles/file/ravajudonifex.pdf, https://agatanorek.com/files/file/84445999761.pdf, https://www.hotel-palladium.gr/wp-content/plugins/super-forms/uploads/php/files/7v3l71h5mijveocudfuoptbb96/74976958176.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Extracted generic config (17 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9779 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• ntp.ubuntu.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787792455&P2=404&P3=2&P4=LyX%2fUZrkqeFnlE3IgCwIc2q0%2b%2bFhnevO45FRvqN5b95l%2bdD7RMqlrM8mHEF%2fOmJMXe8teSeaHZCm3DVE1qPhrg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

• C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\1099cc995cd1bce13c6562a7b7bd1ce9.png - 7c08fd897c9991d8ee295e85a3615df94c2a295787746026b3a211740784747a
• C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 15da562031270f1a98e7bbf8cce6c8d1abdbfb509b7a6af56db0761b609898ec
• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/1xuhb7AK25c/uplcv?utm_term=organic+chemistry+john+e+mcmurry+8th+edition+pdf
• http://perles-del-beya.com/userfiles/file/ravajudonifex.pdf
• https://agatanorek.com/files/file/84445999761.pdf
• https://www.hotel-palladium.gr/wp-content/plugins/super-forms/uploads/php/files/7v3l71h5mijveocudfuoptbb96/74976958176.pdf
• https://brusroom.com/wp-content/plugins/super-forms/uploads/php/files/19ee682ba5907fe55961378a3d459774/nobetigozoma.pdf
• http://makaeximworld.com/wp-content/plugins/formcraft/file-upload/server/content/files/16093b7af9c67b---56076078739.pdf
• https://makemycake.gr/wp-content/plugins/super-forms/uploads/php/files/9oc05k9h9t4qnsdlvfoman8etr/31444404609.pdf
• https://transpack-krumbach.de/_upload_bilder/_filemanager/file/31793625601.pdf
• http://texmet.pl/userimages/file/tozobamejufavufisarovira.pdf
• https://nhathuydesign.com/wp-content/plugins/super-forms/uploads/php/files/1cha2qhi0hn6104cehefsnjsbl/52569432768.pdf
• http://tubietelbar.hu/uploadfile/41412955759.pdf
• http://beiwendq.com/userfiles/file/ponulomelavawejirinixi.pdf
• http://klingende-zeder.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607f8ef7d9fbf---babutefeponu.pdf
• https://planet-for-events.de/userfiles/file/91028084230.pdf
• https://hafa-verein.de/wp-content/plugins/super-forms/uploads/php/files/1a8122febf007374af6f7c30467db425/sogaweragibajaxox.pdf
• https://elitteaccesorios.com/wp-content/plugins/super-forms/uploads/php/files/7cngl1mom5rh441egl4lekrrdr/43760932396.pdf
• http://relocationservicesgroup.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c98e07fcbf---gufomikuz.pdf
• http://unipell.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160b730a2d0cea---gavajefiseni.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/
• http://www.msftconnecttest.com/connecttest.txt

Embedded domains

• feedproxy.google.com
• perles-del-beya.com
• agatanorek.com
• brusroom.com
• makaeximworld.com
• transpack-krumbach.de
• texmet.pl
• nhathuydesign.com
• beiwendq.com
• klingende-zeder.de
• planet-for-events.de
• hafa-verein.de
• elitteaccesorios.com
• relocationservicesgroup.com
• unipell.com.br
• 21.fi
• www.w3.org
• purl.org
• ns.adobe.com
• www.hotel-palladium.gr
• makemycake.gr
• tubietelbar.hu

Embedded IP addresses

• 85.210.193.152
• 52.110.12.48
• 57.154.63.210
• 4.230.171.124
• 74.178.240.51
• 20.76.201.171
• 74.178.76.128
• 52.123.129.14
• 72.153.5.129
• 203.26.79.13
• 52.123.252.193
• 57.155.101.212
• 20.184.175.8
• 135.232.92.34
• 92.223.78.30
• 4.209.250.170
• 20.42.65.91

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report