MALICIOUS — bcb1f3e363b4668f5723d31637e3bdc96e64fc4ba19cf7ec5721122d48242dd7

MALICIOUS — bcb1f3e363b4668f5723d31637e3bdc96e64fc4ba19cf7ec5721122d48242dd7 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: bcb1f3e363b4668f5723d31637e3bdc96e64fc4ba19cf7ec5721122d48242dd7
SHA-1: caf3ad17710f6f99454d703076a08d367675305d
MD5: f6f91889886be0842d4125cb9b4ead10
ssdeep: 1536:D/VINkFMhs7l2KfvizOKJqvsVH5nqP/FtGZnsl3vdgSlIJTQYlIw:z+eNEK20YqXFt8s5bIxQYV
TLSH: T10337D0F35287DE8C7AC75B139EE265A8A0C8D3585523DFA040C4B62CC9BC6AE7D21D11
Submitted as: bcb1f3e363b4668f5723d31637e3bdc96e64fc4ba19cf7ec5721122d48242dd7
File type: pdf · Size: 76235 bytes
Verdict: malicious (98/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!F6F91889886B
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://static.s123-cdn-static-d.com/uploads/4383165/normal_60afe3313108c.pdf - network signal, weight 0.70, confidence 0.80
Contacted 20 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://vilenefex.ru/strik?utm_term=how+to+set+temperature+on+heat+pump, https://static.s123-cdn-static-d.com/uploads/4502336/normal_60b18e4d552ba.pdf, https://rigavimiba.weebly.com/uploads/1/3/0/8/130814992/bagabowudobovelaj.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

10030 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
desktop-hsgcbep
msedge.api.cdp.microsoft.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - d53348874b84aa7c1a7c6b8551b69a52ed85e421a8005dc89a1f436e7fa3783f
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\5c6869bbb1abc7acd69e337be5b392e4.png - 95ba9e3c25e032a8f472c26f0b4e3e721e0e302edb4229b30c0f2f1120d99f1d
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://vilenefex.ru/strik?utm_term=how+to+set+temperature+on+heat+pump
https://static.s123-cdn-static-d.com/uploads/4502336/normal_60b18e4d552ba.pdf
https://rigavimiba.weebly.com/uploads/1/3/0/8/130814992/bagabowudobovelaj.pdf
https://static.s123-cdn-static-d.com/uploads/4383165/normal_60afe3313108c.pdf
https://cdn-cms.f-static.net/uploads/4453117/normal_606b7f8f34fbc.pdf
https://danuxuzajuzawo.weebly.com/uploads/1/3/4/7/134768569/kepununemagopoja.pdf
https://jaxuvoxet.weebly.com/uploads/1/3/5/9/135979876/90af12b.pdf
https://static.s123-cdn-static.com/uploads/4401714/normal_5ff28a0777e11.pdf
https://uploads.strikinglycdn.com/files/61fdbbed-ccb0-4738-83ad-05de6a347ff8/what_is_offsite_storage.pdf
https://cdn-cms.f-static.net/uploads/4414869/normal_60688ef2639b6.pdf
https://cdn-cms.f-static.net/uploads/4449184/normal_6045f77cbf0c4.pdf
https://geselumagema.weebly.com/uploads/1/3/4/6/134695037/xulasanesifuvok.pdf
https://uploads.strikinglycdn.com/files/6e88e7db-a36f-4557-9608-c56bdf6545ab/jojim.pdf
https://sejumajofejopib.weebly.com/uploads/1/3/2/7/132740214/texuligagex-fatijoxaf.pdf
https://cdn-cms.f-static.net/uploads/4414487/normal_604145bb795b0.pdf
https://cdn-cms.f-static.net/uploads/4465249/normal_60395da15f19e.pdf
https://cdn-cms.f-static.net/uploads/4372983/normal_600ead0c89072.pdf
https://static.s123-cdn-static.com/uploads/4366965/normal_600346654a31f.pdf
https://cdn-cms.f-static.net/uploads/4465403/normal_6060e8ca78005.pdf
https://motonikepo.weebly.com/uploads/1/3/0/7/130739202/cd88ad539a0b3.pdf
https://cdn-cms.f-static.net/uploads/4373261/normal_600d7c4b69af8.pdf
https://jojimixumomural.weebly.com/uploads/1/3/4/4/134438106/b8043d7dd52.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/

Embedded domains

vilenefex.ru
static.s123-cdn-static-d.com
rigavimiba.weebly.com
cdn-cms.f-static.net
danuxuzajuzawo.weebly.com
jaxuvoxet.weebly.com
static.s123-cdn-static.com
uploads.strikinglycdn.com
geselumagema.weebly.com
sejumajofejopib.weebly.com
motonikepo.weebly.com
jojimixumomural.weebly.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

74.178.240.61
52.123.252.243
74.178.76.44
52.110.12.54
20.42.179.192
4.230.171.124
203.26.79.13
135.233.95.135
4.150.223.104
135.232.92.137
20.112.250.133
52.123.129.14
52.123.252.239
20.165.94.63
20.42.73.24
135.233.45.221
48.192.143.121
20.184.175.15
52.148.114.188
142.250.195.163

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report