MALICIOUS — bca5b0f3f91134888a70d129f9beb7178907d34817b8e2496cf2a9a1292b1534

MALICIOUS — bca5b0f3f91134888a70d129f9beb7178907d34817b8e2496cf2a9a1292b1534 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: bca5b0f3f91134888a70d129f9beb7178907d34817b8e2496cf2a9a1292b1534
SHA-1: 51aa8427e8c3422083711424506e4b8a4fe58aa2
MD5: 0e85c8f2519804f8e6f4c150fbc1c0af
ssdeep: 1536:LlQjItxCkenjQ6brPXXMh1MTQLSg7suP3xmvZWbpONiWDyHzLo1g:BvxDejBXXX+eTQL75BmvbNRE9
TLSH: T16B37C0F350ABCD4C7787C74329EA21686455F3986172EE918488BBACC57CA7DBF00911
Submitted as: bca5b0f3f91134888a70d129f9beb7178907d34817b8e2496cf2a9a1292b1534
File type: pdf · Size: 74134 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://lednotice.com/userData/board/file/25393112853.pdf - network signal, weight 0.70, confidence 0.80
Contacted 19 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://laborke.ru/uplcv?utm_term=14+vpn+apk, https://www.helpfulhunks.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/16147c97c69922---negoseliwasilojevadas.pdf, http://lednotice.com/userData/board/file/25393112853.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9702 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - be7e2b7ac8e72d3ff2f15c2a3415e1340e9fad62fc907173ff0be1951f402ba9
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\29bea4e673720752c0dfc40eff23fd0b.png - ca2f544a4d79fc20c98090d413d737c969c74535db3232cc8d9c7b79a17ab463
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://laborke.ru/uplcv?utm_term=14+vpn+apk
https://www.helpfulhunks.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/16147c97c69922---negoseliwasilojevadas.pdf
http://lednotice.com/userData/board/file/25393112853.pdf
http://harchovyk.com/userfiles/file/14980672692.pdf
https://playgametoday.ru/wp-content/plugins/super-forms/uploads/php/files/7cd43744842a9f65e31c9600497dc295/29085389711.pdf
http://plymouth-logs.co.uk/ckfinder/userfiles/files/wiken.pdf
https://iqrainternationalschool.org/_assets/files/nuzozuzadobofanitorubuza.pdf
http://imbirimbir.ru/files/mivoxirivikifufekafozamu.pdf
http://umrllc.com/userfiles/files/53410197103.pdf
http://www.kissdocs.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1612eac06bb169---moxawenuwe.pdf
https://gikguamerica.com/userfiles/file/68883630859.pdf
http://cen7dias.es/userfiles/files/3866372849.pdf
https://music-group-store.com/upload/files/99455761090.pdf
http://ipmarketing.net/FCKeditor/editor/filemanager/connectors/userfiles/file/81661426697.pdf
http://thegrcinstitute.org/app/webroot/js/ckfinder/userfiles/files/16635793848.pdf
http://viaterrestre.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/161437fab0eac2---58920005700.pdf
http://dedanskecasinoer.dk/userfiles/file/mabadodemilipikad.pdf
http://emailreceptionist.net/userfiles/file/fumewomisikenaxe.pdf
http://globalcenterhotels.com/bot/ckfinder/uf/files/74893978802.pdf
http://netisiletisim.com/guvennet/resimlerfiles/kamoginazidorupuxu.pdf
http://bjoybrands.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614904cab9140---vibabosusorajojof.pdf
https://ever-progress.dacola.com/upload/files/79475172743.pdf
http://studiophotosfashion.it/userfiles/files/42204639197.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/

Embedded domains

laborke.ru
www.helpfulhunks.com.au
lednotice.com
harchovyk.com
playgametoday.ru
plymouth-logs.co.uk
iqrainternationalschool.org
imbirimbir.ru
umrllc.com
www.kissdocs.com.au
gikguamerica.com
cen7dias.es
music-group-store.com
ipmarketing.net
thegrcinstitute.org
viaterrestre.com.br
emailreceptionist.net
globalcenterhotels.com
netisiletisim.com
bjoybrands.com
ever-progress.dacola.com
studiophotosfashion.it
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

20.50.201.195
52.110.12.2
72.154.7.97
4.230.171.124
203.26.79.13
52.230.59.222
57.155.104.224
52.123.252.234
51.11.192.48
20.236.44.162
40.103.64.242
74.178.76.128
52.123.128.14
74.178.240.61
135.233.95.80
92.223.78.30
4.150.223.109
172.170.180.133
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report