MALICIOUS — c4626929908bd0f71d05521c6eaeb6801bbb97e29e2dac980bf580a0dff47382

MALICIOUS — c4626929908bd0f71d05521c6eaeb6801bbb97e29e2dac980bf580a0dff47382 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: c4626929908bd0f71d05521c6eaeb6801bbb97e29e2dac980bf580a0dff47382
SHA-1: a777ff31f4f9637f28f14f2941085d9f13046484
MD5: c85a109e8d532e93a7d3a1546d01fdd4
ssdeep: 1536:tJOUcgtx2YNC4FN3bhO9u7fKBslXEsJMQtQZF9wFIWEpQmhAJfQWwpOSg8D:Rck2mFGI7fQsKsJp0bwFULANfS7
TLSH: T13438C0F331A7DD5C7B6B4B8369B65199609EB7882112EEA0408C7B3C857C4FE6F04A11
Submitted as: c4626929908bd0f71d05521c6eaeb6801bbb97e29e2dac980bf580a0dff47382
File type: pdf · Size: 82267 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://neksav.com/upload/ckfinder/files/xekasode.pdf - network signal, weight 0.70, confidence 0.80
Contacted 20 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://savaksangida.com/resimler/files/bukamegegut.pdf, http://uat2.hkha.com.hk/ckfinder/userfiles/files/88613307205.pdf, http://braintradingbcn.com/wp-content/plugins/super-forms/uploads/php/files/2a85f04eedf83597073a4d289fb560b7/nezotelurikagivod.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9732 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
desktop-hsgcbep
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787917556&P2=404&P3=2&P4=DEpI37PADgDrypWGDMS3hYSq9%2bOUUuIp%2fW5K3lv1ktMggEKPPd75jqMmszpi73vb9v%2b3RVHTZojQoyX%2b6kigjg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787917613&P2=404&P3=2&P4=QSZBl9synpW2VF3w7yksqsgLq8qi3L%2fRDMp2wfPzFrN2r2WOICJPRa27KTrlYzNAMC%2fSLea0GAZqZ2ZA40XZ4w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\497ef13c1d468d47ae4be73060543d83.png - 3e11b2bdd6e0d351b1aefc09b59ae874b6af0009d81a64a97ffdad170d5d2307
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 19306da2c3b43256938a40b61a9af17ec53fc5cae007197ffaaf7e515cd124c2
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

http://feedproxy.google.com/~r/Xvkpad/~3/6Zflnl449io/uplcv?utm_term=take+into+action+meaning
http://savaksangida.com/resimler/files/bukamegegut.pdf
http://uat2.hkha.com.hk/ckfinder/userfiles/files/88613307205.pdf
http://braintradingbcn.com/wp-content/plugins/super-forms/uploads/php/files/2a85f04eedf83597073a4d289fb560b7/nezotelurikagivod.pdf
https://desertflying.club/wp-content/plugins/formcraft/file-upload/server/content/files/16138ada1c00ac---67209125463.pdf
http://unseretochter.ch/images/file/19241329602.pdf
https://neksav.com/upload/ckfinder/files/xekasode.pdf
http://bankerz.in/qpic/files/wedudesowabadososasolomev.pdf
https://khanoomhoteli.com/basefile/khanoomhotelicom/files/9918024732.pdf
http://ttccid.com/userfiles/files/jujuxonuz.pdf
http://riasztoszolnok.hu/admin/fck_upload/file/84900024021.pdf
https://selectwifi.com/wp-content/plugins/formcraft/file-upload/server/content/files/1617a4cf608659---xekojiropanamakedam.pdf
http://kinel-hunter.ru/upfiles/file/fozogoneguzakejugofovi.pdf
http://fazekaskozpont.hu/images/upload/file/zanamojaledegiwuj.pdf
http://opt-russtd.ru/data_center/upload_pictures/file/74104534938.pdf
http://myepres.com/HotelEstimator/userfiles/file/46098736280.pdf
https://huaienclinic.com/uploadpic/files/zexowujenutizesotig.pdf
https://www.sblending.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1613e16e894d4e---segepo.pdf
http://www.expo-hotel.com/english/wp-content/plugins/formcraft/file-upload/server/content/files/1617182fbac613---46105398194.pdf
http://sithome.com/upfiles/file/20211016123423.pdf
https://nepalonlineexam.tisaracademy.com/userfiles/files/98546332280.pdf
http://balony.dmuchance.eu/userfiles/file/19546692470.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/

Embedded domains

feedproxy.google.com
savaksangida.com
uat2.hkha.com.hk
braintradingbcn.com
desertflying.club
unseretochter.ch
neksav.com
bankerz.in
khanoomhoteli.com
ttccid.com
selectwifi.com
kinel-hunter.ru
opt-russtd.ru
myepres.com
huaienclinic.com
www.sblending.com.au
www.expo-hotel.com
sithome.com
nepalonlineexam.tisaracademy.com
balony.dmuchance.eu
www.w3.org
purl.org
ns.adobe.com
riasztoszolnok.hu
fazekaskozpont.hu

Embedded IP addresses

4.150.223.115
20.184.175.23
203.26.79.13
20.184.175.20
74.178.232.29
52.110.12.2
4.230.171.124
72.154.7.104
172.215.188.225
74.178.240.51
74.178.76.128
52.123.128.14
135.234.160.244
51.116.253.169
92.223.78.30
51.132.193.105
172.175.111.170
13.69.116.109
20.184.175.12
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report