MALICIOUS — 1378f5_40f19f78dc0a434b86fc3290ba6d52a6.pdf

MALICIOUS — 1378f5_40f19f78dc0a434b86fc3290ba6d52a6.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: bf74b6a51f091f391f79baf21060fc7e09f3a54efa28c3aee19be6e8f343643e
• SHA-1: 3655944436904809e25159e89cf5408c2cb9a061
• MD5: 6c830a4f9621be888b9ed39a397b63fb
• ssdeep: 1536:P4GzdxG7mjamnjiLS+jVk6MucjAoPykoNXLs/eT0A8/EdPDgQdwc:VOPspWG6MzsoakoN7T9PDDJ
• TLSH: T19438DFF3116FDD8CA762EB43AEB6101D2491E74D51326BA804C87E2CC2F8ABD7D64941
• Submitted as: 1378f5_40f19f78dc0a434b86fc3290ba6d52a6.pdf
• File type: pdf · Size: 78251 bytes
• Verdict: malicious (98/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!6C830A4F9621
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1105
• T1566.002

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4427501/normal_5ffa716954676.pdf - network signal, weight 0.70, confidence 0.80
• Contacted 22 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
• Embedded network infrastructure: https://yafferge.ru/wix?keyword=ariana+grande+poster+thank+u+next, http://health2health.online/24066689619y5qyj.pdf, http://palorobumuwew.iblogger.org/koxegulebivak.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9883 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• 250.255.255.239.in-addr.arpa
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• ntp.ubuntu.com
• desktop-hsgcbep._dosvc._tcp.local
• desktop-hsgcbep
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

• C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\36dad543f4b2fecb359147de130b3c94.png - 87d71aa71ce94ad57eb4439afb28cb44f7e3f91eabee20b5f34f4ba5df5fa6e6
• C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - e454bc7980665e4c5d9d57bcccfee33f0fefbf6b07430db22658008b08257349
• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://yafferge.ru/wix?keyword=ariana+grande+poster+thank+u+next
• http://health2health.online/24066689619y5qyj.pdf
• http://palorobumuwew.iblogger.org/koxegulebivak.pdf
• https://static.s123-cdn-static.com/uploads/4427501/normal_5ffa716954676.pdf
• http://songkfrk.site/688108142474ysuw.pdf
• http://jexiduro.rf.gd/al_quran_30_juz_full.pdf
• http://firstdoctor.xyz/87806192376dw4vu.pdf
• https://cdn.sqhk.co/fasisela/dCvr8gi/54321771504.pdf
• http://nokolul.epizy.com/map_of_benue_state.pdf
• http://lipidusixul.rf.gd/91297109591.pdf
• http://fexevosekuzavep.iblogger.org/48410225892.pdf
• https://static.s123-cdn-static.com/uploads/4474746/normal_5fcd57f1c5d23.pdf
• https://static.s123-cdn-static.com/uploads/4371258/normal_6000568e7db77.pdf
• http://sanatoriy-izumrudny.ru/extreme_car_driving_simulator_2020_mod_apkr2x71.pdf
• http://dekifovep.epizy.com/22224344982.pdf
• http://pokazirajig.rf.gd/dobutamo.pdf
• https://static.s123-cdn-static.com/uploads/4471995/normal_5fff6a7f2e6d3.pdf
• http://tumbochka.space/68388126072csg9n.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/
• http://www.msftconnecttest.com/connecttest.txt

Embedded domains

• yafferge.ru
• health2health.online
• palorobumuwew.iblogger.org
• static.s123-cdn-static.com
• songkfrk.site
• firstdoctor.xyz
• cdn.sqhk.co
• nokolul.epizy.com
• fexevosekuzavep.iblogger.org
• sanatoriy-izumrudny.ru
• dekifovep.epizy.com
• tumbochka.space
• www.w3.org
• purl.org
• ns.adobe.com
• jexiduro.rf.gd
• lipidusixul.rf.gd
• pokazirajig.rf.gd

Embedded IP addresses

• 20.165.94.46
• 72.154.7.100
• 20.42.65.89
• 52.123.252.248
• 52.110.12.56
• 4.247.188.224
• 20.247.184.142
• 4.230.171.124
• 72.154.7.99
• 135.232.92.97
• 203.26.79.13
• 51.104.15.252
• 135.233.95.144
• 20.112.250.133
• 40.103.64.242
• 52.123.129.14
• 92.223.78.30
• 57.154.63.210
• 20.184.175.14
• 4.150.223.109
• 52.148.114.188
• 142.250.195.163

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report