MALICIOUS — c2f970f1e647db0d0e09e78ac20ff24787941f18f90341c6a52fe5891d75b278

MALICIOUS — c2f970f1e647db0d0e09e78ac20ff24787941f18f90341c6a52fe5891d75b278 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: c2f970f1e647db0d0e09e78ac20ff24787941f18f90341c6a52fe5891d75b278
SHA-1: e10caa307ef16884d48391077840261d9924d50e
MD5: f4626b4d56064b3286169790ce343b21
ssdeep: 1536:lWx85hx+6XOyArqLE9GHJ27fjcz2LqucFGcKK799HU9JuflWcw5Kacr:4x83x5goaczgBaGcKa99HUCW5K1
TLSH: T17839D1F36197CD9C7E876F8359F12668698AD7487032CA50008AA76CC5786FDBF61C20
Submitted as: c2f970f1e647db0d0e09e78ac20ff24787941f18f90341c6a52fe5891d75b278
File type: pdf · Size: 91842 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://zovafidat.pbworks.com/w/file/fetch/145172667/45107688155.pdf - network signal, weight 0.70, confidence 0.80
Contacted 22 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://oniceh.ru/pbw?utm_term=dilation+activity+1+king+tut+answers, https://nosodawef.weebly.com/uploads/1/3/4/6/134693330/tepenomif.pdf, http://zovafidat.pbworks.com/w/file/fetch/145172667/45107688155.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (12 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9697 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\f68f212dd4894862c335a6821d1788be.png - f80d2ca0a1eb0fc1fd8157be9594a5b594438bd997f157fe900dbdfa6e3d7440
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 48e8e34a89ac9f832f0fd6f2be1f0ac8f6766444cb7936511d01a2a2d89075ee
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://oniceh.ru/pbw?utm_term=dilation+activity+1+king+tut+answers
https://nosodawef.weebly.com/uploads/1/3/4/6/134693330/tepenomif.pdf
http://zovafidat.pbworks.com/w/file/fetch/145172667/45107688155.pdf
https://static.s123-cdn-static-d.com/uploads/4408004/normal_60b72c649dea2.pdf
http://nugewil.pbworks.com/w/file/fetch/144606903/xujilolitem.pdf
http://rimikupababo.pbworks.com/f/45590730752.pdf
http://xuzutoli.pbworks.com/w/file/fetch/145172043/waposegijuxapidadijetirat.pdf
https://static.s123-cdn-static.com/uploads/4375514/normal_5fc896a975aa7.pdf
https://cdn-cms.f-static.net/uploads/4388169/normal_60655cc59cf28.pdf
https://gazolono.weebly.com/uploads/1/3/4/7/134721713/zojumuditusa_jinewovu_vavup_duxufebatego.pdf
https://xonarupitowij.weebly.com/uploads/1/3/4/6/134617661/bisasejoru_wawudurame.pdf
https://static.s123-cdn-static.com/uploads/4366637/normal_5fe449968f5fc.pdf
https://cdn-cms.f-static.net/uploads/4411918/normal_606e3c35af0be.pdf
https://lopekemin.weebly.com/uploads/1/3/4/6/134628767/silasiselesaj.pdf
https://static.s123-cdn-static.com/uploads/4487399/normal_5ffb461465349.pdf
https://rukepeninosiwul.weebly.com/uploads/1/3/1/4/131406291/8f85fd3fed15d.pdf
https://rovividupezudu.weebly.com/uploads/1/3/4/3/134373795/6847972.pdf
https://cdn-cms.f-static.net/uploads/4425209/normal_605105dcec1e9.pdf
https://belawutuvuzepim.weebly.com/uploads/1/3/4/6/134605506/fimoxo.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

oniceh.ru
nosodawef.weebly.com
zovafidat.pbworks.com
static.s123-cdn-static-d.com
nugewil.pbworks.com
rimikupababo.pbworks.com
xuzutoli.pbworks.com
static.s123-cdn-static.com
cdn-cms.f-static.net
gazolono.weebly.com
xonarupitowij.weebly.com
lopekemin.weebly.com
rukepeninosiwul.weebly.com
rovividupezudu.weebly.com
belawutuvuzepim.weebly.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

4.150.223.109
4.150.223.108
52.123.252.231
52.110.12.15
172.215.188.225
4.230.171.124
74.178.76.128
4.150.223.105
20.231.239.246
40.103.64.242
52.123.129.14
52.123.128.14
40.99.133.242
57.154.63.210
135.233.95.80
72.154.7.111
203.26.79.13
52.123.252.203
20.42.65.85
4.150.223.104
4.150.223.96
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report