MALICIOUS — 29371957463.pdf

MALICIOUS — 29371957463.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: c663e0dd41e26e38e418c0a6665d7f4e6ab06b8c599d60c229b82fea2ac5ba82
SHA-1: ae35e5dff2e0d6770890ac0c05e2d037708ccfab
MD5: 6cbe46772be8f46e292d907098268339
ssdeep: 1536:gNUdCEIorCiJFLJW5peT8UyxE6WCpOVibFZcWi5NDwfs:nd6S7LJW5pQ7yAVibFZADL
TLSH: T1A938D0F36197CD1C7789DB035ABA15A8B4C5E7C9A072E691408077ACD87C6BDBF20920
Submitted as: 29371957463.pdf
File type: pdf · Size: 76823 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Contacted 15 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://lhjmfamily.com/clients/5/5d/5d8645f74963a96e1aea25f3b610eff6/File/19958844509.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://huntic.ru/uplcv?utm_term=rock+characterization+testing+and+monitoring+pdf, http://akinmedical.com/uploads/file/55503462659.pdf, http://morecoredesign.com/images/imageUps/files/57315931115.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9664 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
250.255.255.239.in-addr.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
255.255.254.169.in-addr.arpa
251.0.0.224.in-addr.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\35a3b5fef4f3e722d6973337b1337018.png - cd9ebec4120ef86e2934872a94d53d74fe78d336869971411f21bd49e64b5183
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 7b0729da85bc5080f3a71c3b5c562c15343b83e3ad6bf6f4f1d14f3f80c657c2
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://huntic.ru/uplcv?utm_term=rock+characterization+testing+and+monitoring+pdf
http://akinmedical.com/uploads/file/55503462659.pdf
http://morecoredesign.com/images/imageUps/files/57315931115.pdf
http://bjjiffy.com/upload/filolaxalawanejaf.pdf
http://www.blackhillsdancecentre.com/wp-content/plugins/formcraft/file-upload/server/content/files/16072221066cf9---sukinumer.pdf
https://www.havanasalsa-dance-tours.com/wp-content/plugins/super-forms/uploads/php/files/b9df6c3009bfcaec8f7e3eb5d7632dba/nituviwununukiverur.pdf
http://www.radio-kum.si/data/files/72055579305.pdf
http://degrossier.nl/uploads/file/gulobamazivegonuf.pdf
https://rgcsmt.org/ckfinder/userfiles/files/90639388286.pdf
http://lhjmfamily.com/clients/5/5d/5d8645f74963a96e1aea25f3b610eff6/File/19958844509.pdf
http://birons.net/wp-content/plugins/super-forms/uploads/php/files/4ec12a19d2c7b02863f3aa5d27741d52/dimufoxozap.pdf
http://www.gainerwindows.ca/wp-content/plugins/super-forms/uploads/php/files/ii3ccj1k64hnkjkuos346cchi6/zakixubu.pdf
http://yuseigachi.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16074dbbbd2ed5---77646761777.pdf
http://enovosti.info/ckfinder/userfiles/files/gavumimawododalit.pdf
https://www.sgestrecho.es/wp-content/plugins/formcraft/file-upload/server/content/files/16089fab7d9b9f---lefigozetofawonekeramij.pdf
http://nocleginaplus.pl/uploads/userfiles/files/92171590539.pdf
http://chemicalengineers.ie/images/labalokemawij.pdf
http://privateeducation.sg/verzsape/demo/upload/admin/files/lupevilinepojitunof.pdf
https://oncallanatomist.org/ckfinder/userfiles/files/18417183439.pdf
http://rydelko.pl/userfiles/file/vijurururubapave.pdf
https://cavalier-hundezucht.ch/userfiles/file/86141222313.pdf
https://zapret-rf.org/web/img/podborky/files/kogusudikumoxafomil.pdf
https://fulzugaskozpont.hu/files/41766878787.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/

Embedded domains

huntic.ru
akinmedical.com
morecoredesign.com
bjjiffy.com
www.blackhillsdancecentre.com
www.havanasalsa-dance-tours.com
degrossier.nl
rgcsmt.org
lhjmfamily.com
birons.net
www.gainerwindows.ca
yuseigachi.nl
enovosti.info
www.sgestrecho.es
nocleginaplus.pl
privateeducation.sg
oncallanatomist.org
rydelko.pl
cavalier-hundezucht.ch
zapret-rf.org
www.w3.org
purl.org
ns.adobe.com
www.radio-kum.si
chemicalengineers.ie

Embedded IP addresses

52.123.252.242
52.110.12.19
52.110.12.49
4.230.171.124
4.155.93.171
74.178.76.44
72.145.35.106
203.26.79.13
74.178.240.51
20.76.201.171
74.178.240.61
40.84.97.4
92.223.78.30
20.42.73.31
48.199.12.1

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report