MALICIOUS — pedusutapumaxijifelimitan.pdf

MALICIOUS — pedusutapumaxijifelimitan.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: bd44ddad02c06b46f546b7e17405099f3ee6b94618b0fae5e26bf8a00384c4f3
SHA-1: 561d5b0ca0f637e652d87a3ec7a33c5f6c9bb847
MD5: 72fa58a5a59127c5bc73d5510f886635
ssdeep: 1536:bgP6J159OvJdEwEmuCkIdQ8+DDyWpIl6e17WQDhmNA6oEIfUq+V3W8pO7l8EJ:NJ17LY5dX0DyZEYDAAZ9CVK7r
TLSH: T18438D0F320A7CD4C7B8E8B07A5EB21AA7419F3482172E5A41188766D847C5FFBF14611
Submitted as: pedusutapumaxijifelimitan.pdf
File type: pdf · Size: 82279 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Contacted 24 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://travelselection.us/wp-content/plugins/formcraft/file-upload/server/content/files/1613bd37c4384b---41664864770.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://inwebjor.ru/uplcv?utm_term=voice+changer+for+discord+on+android, http://www.egymast-segito.hu/uploaded/fck/file/68856935781.pdf, http://crosswaysrecruitment.com/userfiles/file/16727916138.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9718 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
desktop-hsgcbep._dosvc._tcp.local
ntp.ubuntu.com
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - b5db58b74bc608d5940dfb7e7ed29b2a3960d148d843732e67cc071247ee64c3
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\34cb7c7f6138ba4c2a5f8f42253d60c2.png - 492079976019dda353d9198dcc4c0cbb910ed70c8480bf2d6fd64b2da867a1a7
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://inwebjor.ru/uplcv?utm_term=voice+changer+for+discord+on+android
http://www.egymast-segito.hu/uploaded/fck/file/68856935781.pdf
http://crosswaysrecruitment.com/userfiles/file/16727916138.pdf
https://foodthings.us/userfiles/file/pobuvubasikinatitiw.pdf
https://sherwoodchamber.org/ckfinder/userfiles/files/kazipimenexu.pdf
https://markapin.com/calisma2/files/uploads/lalorefanusininemovo.pdf
https://travelselection.us/wp-content/plugins/formcraft/file-upload/server/content/files/1613bd37c4384b---41664864770.pdf
http://asupuro.com/user_data/image/file/famuzerig.pdf
http://ekbdrive.ru/ckfinder/userfiles/files/50004334804.pdf
http://theffirm.com/userfiles/file/15796198525.pdf
https://brothers-music.com/ckfinder/userfiles/files/32927004804.pdf
https://victory-agency.com/wp-content/plugins/formcraft/file-upload/server/content/files/16145c67a5f053---14769809064.pdf
http://galsabino.it/userfiles/files/wumuxekevutinipigajigogo.pdf
http://tatagz.com/uploadfile/files/16064139547.pdf
https://www.ogblfrontaliers.fr/wp-content/plugins/super-forms/uploads/php/files/s5gn05spgahv85q59ca0ng42d8/38597836826.pdf
http://www.cenlaenvironmental.com/siteuploads/editorimg/file/7213811792.pdf
http://famcareconnect.org/wp-content/plugins/formcraft/file-upload/server/content/files/16142f3923c5d5---67122313999.pdf
http://tk-weld.com/images/library/File/repafosigoza.pdf
http://www.kissdocs.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1613b34649b5e3---sitida.pdf
http://pck.malopolska.pl/wp-content/plugins/super-forms/uploads/php/files/47ce7723e4beb928d0100e54181f8038/28185062480.pdf
http://neoneofitou.com/ckfinder/userfiles/files/33142186067.pdf
http://www.mab-solutions.fr/upload/file/nakajemubug.pdf
https://vibangnhadat.com/uploads/files/jelisuzumuko.pdf
https://conexusinternational.com/ckfinder/userfiles/file/40087342082.pdf
https://giaiphapthietke.vn/media/file/files/50803536627.pdf

Embedded domains

inwebjor.ru
crosswaysrecruitment.com
foodthings.us
sherwoodchamber.org
markapin.com
travelselection.us
asupuro.com
ekbdrive.ru
theffirm.com
brothers-music.com
victory-agency.com
galsabino.it
tatagz.com
www.ogblfrontaliers.fr
www.cenlaenvironmental.com
famcareconnect.org
tk-weld.com
www.kissdocs.com.au
pck.malopolska.pl
neoneofitou.com
www.mab-solutions.fr
vibangnhadat.com
conexusinternational.com
eclipsetheaters.com
www.w3.org

Embedded IP addresses

20.42.73.31
57.155.104.224
51.104.15.252
172.215.188.225
52.123.252.218
20.42.73.28
52.110.12.48
52.110.12.32
4.230.171.124
4.247.188.233
135.233.95.135
135.233.95.144
40.104.4.2
20.50.201.203
52.123.128.14
40.99.133.226
40.99.133.242
74.179.71.159
203.26.79.13
162.159.142.9
142.250.195.131
4.150.223.115
48.200.63.27
20.42.65.85

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report