MALICIOUS — c0c4a4eee169cb9b5525ce7665f97c5aa6b95c0a62bb9ab389e1fe97c4529e6b

MALICIOUS — c0c4a4eee169cb9b5525ce7665f97c5aa6b95c0a62bb9ab389e1fe97c4529e6b is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 3 of 54 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: c0c4a4eee169cb9b5525ce7665f97c5aa6b95c0a62bb9ab389e1fe97c4529e6b
SHA-1: 356848046ebd36e562f592b743181624e884d2fb
MD5: 2a2385f43e37e00b1db119582960c323
ssdeep: 1536:m53g/ejGKISNu0oMZEIcN9uRAkBrvzLnzUFAFSdW78vzUnoUlNd:P2jvNEjHcAk9vnAFQSb7UogNd
TLSH: T1DE37E1F3416FAD0CBE9A5B42EDBE1168998AC3C92133D551108CA76CD0BC6BEFE12501
Submitted as: c0c4a4eee169cb9b5525ce7665f97c5aa6b95c0a62bb9ab389e1fe97c4529e6b
File type: pdf · Size: 71945 bytes
Verdict: malicious (99/100)

Detections (3 of 54 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://taiwan-casters.com/userfiles/file/61373943359.pdf - network signal, weight 0.70, confidence 0.80
Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://taiwan-casters.com/userfiles/file/61373943359.pdf, https://www.medipratik.com/wp-content/plugins/formcraft/file-upload/server/content/files/16141f857d94e6---207239166.pdf, http://donkaew-furniture.com/ckfinder/userfiles/files/futaxapin.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Contacted 6 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

1077 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
23.40.52.209
23.11.37.157
40.126.14.160
52.123.252.227 AU · Sydney · AS8075 Microsoft Corporation
23.33.238.178
23.198.40.44
4.230.171.124 KR · Seoul · AS8075 Microsoft Corporation
23.33.238.173
4.144.132.223 SG · Singapore · AS8075 Microsoft Corporation
23.33.238.106
192.168.122.116
20.42.65.89 US · Flint Hill · AS8075 Microsoft Corporation

Dropped files

root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/PmAiG5ZyT-k/uplcv?utm_term=how+to+clear+cookies+on+android+phone
http://taiwan-casters.com/userfiles/file/61373943359.pdf
https://www.medipratik.com/wp-content/plugins/formcraft/file-upload/server/content/files/16141f857d94e6---207239166.pdf
http://donkaew-furniture.com/ckfinder/userfiles/files/futaxapin.pdf
https://www.coconutlodge.com/wp-content/plugins/formcraft/file-upload/server/content/files/16134df9e3263c---dowunogam.pdf
http://www.gabrielamaciel.net/images/content/file/xasotifew.pdf
http://caacoding.net/wp-content/plugins/formcraft/file-upload/server/content/files/1613cca6106567---jomagoveganago.pdf
https://www.yoursurveysurveyors.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/161365c09be143---1907779547.pdf
http://www.pibmg.com.br/ckfinder/userfiles/files/files/64819638435.pdf
https://jackyrouxmethode.com/userfiles/file/42642396574.pdf
http://mardeestilos.es/fotos/file/48190835882.pdf
http://ankaraeksioglu.com/resimler/files/19516431865.pdf
http://chi-kara.net/Upload/files/6296414706.pdf
http://tatnhapkhau.com/ckfinder/userfiles/files/21871490046.pdf
http://coimbra.hu/uploads/ckfinder/userfiles/files/66048372407.pdf
http://kco.su/userfiles/file/65880346923.pdf
https://microfocus-realize2020mea.com/wp-content/plugins/super-forms/uploads/php/files/e34dc83a390987b712c0f5a313620bda/bupuxugi.pdf
http://cu-hinothai.com/ckfinder/userfiles/files/7239984474.pdf
http://dar-tom.pl/userfiles/file/wufotaka.pdf
http://paddockj.com/user_data/editor/ckfinder/core/connector/php/upload/files/jiluzenokifagexe.pdf
http://www.loicadesacavem.pt/wp-content/plugins/formcraft/file-upload/server/content/files/1612fb63bdf52a---memaresawezuwunub.pdf
http://plenar.hr/wp-content/plugins/formcraft/file-upload/server/content/files/16134f7b3cdad5---86415886360.pdf
http://okvin.org/userfiles/file/16353704531.pdf
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Embedded domains

feedproxy.google.com
taiwan-casters.com
www.medipratik.com
donkaew-furniture.com
www.coconutlodge.com
www.gabrielamaciel.net
caacoding.net
www.yoursurveysurveyors.co.uk
www.pibmg.com.br
jackyrouxmethode.com
mardeestilos.es
ankaraeksioglu.com
chi-kara.net
tatnhapkhau.com
kco.su
microfocus-realize2020mea.com
cu-hinothai.com
dar-tom.pl
paddockj.com
okvin.org
coimbra.hu
www.loicadesacavem.pt
plenar.hr

Embedded IP addresses

52.123.252.227
4.230.171.124
4.144.132.223
20.42.65.89
72.153.5.63
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report