MALICIOUS — c84cb6f1dd97ac629bf190dbb2a339ffeb4b156643e7799fb096ff37b266dac4

MALICIOUS — c84cb6f1dd97ac629bf190dbb2a339ffeb4b156643e7799fb096ff37b266dac4 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: c84cb6f1dd97ac629bf190dbb2a339ffeb4b156643e7799fb096ff37b266dac4
SHA-1: 5362ebfffc9740402ae510e07a5c6e29d2b0ae5f
MD5: fcbef7dc06333adbb3fb97cde70f6771
ssdeep: 1536:44dIxyw4Q0nyWqaCGShAHy9aFV/Km3gC1vofRpZyW314:DdIxx4QUyWqaFHeY8ZPyWq
TLSH: T16937C0F381ABCE8C37876B977D96416C710AC6886172AAA444C4FB6CC6BC27D2F11C51
Submitted as: c84cb6f1dd97ac629bf190dbb2a339ffeb4b156643e7799fb096ff37b266dac4
File type: pdf · Size: 73743 bytes
Verdict: malicious (98/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!FCBEF7DC0633
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://mygotour.com/FileData/ckfinder/files/20210611_664630A6886D0C02.pdf - network signal, weight 0.70, confidence 0.80
Contacted 21 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://coretry.ru/uplcv?utm_term=how+to+change+to+pdf+on+mac, http://aep-tc.com/cache/fck_files/file/fevadejoxoxejogot.pdf, http://chinalabware.ru/d/files/tuvuzivi.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9770 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 3d24f275ac2f2e6ac75ba6f7f477370b6db03d3cd712147002254daadfcccf53
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\283d2d2795498671eb168d3a0f717b34.png - ca481191439c18f36c6f75b2c923c7aff2aa41692fa9f7a5e9dc0aed9723e010
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://coretry.ru/uplcv?utm_term=how+to+change+to+pdf+on+mac
http://aep-tc.com/cache/fck_files/file/fevadejoxoxejogot.pdf
http://chinalabware.ru/d/files/tuvuzivi.pdf
http://israel-aliya.com/wp-content/plugins/super-forms/uploads/php/files/5525ddb683da585fcd331faab9f99c92/taropulanofozobon.pdf
http://thanhlamresort.vn/wp-content/plugins/formcraft/file-upload/server/content/files/160b6b60822cda---biwevogije.pdf
http://imagespa.mx/wp-content/plugins/formcraft/file-upload/server/content/files/16072b52617925---wibava.pdf
http://careerhack.net/wp-content/plugins/formcraft/file-upload/server/content/files/1608ae35b34616---ferefegoma.pdf
https://mavismanagement.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607cc305b90e8---78458154030.pdf
https://cffcommunications.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1/160bdc49a927d4---nazevimotosodefimebol.pdf
http://mygotour.com/FileData/ckfinder/files/20210611_664630A6886D0C02.pdf
https://tenfci.org/userfiles/file/33518006086.pdf
http://macabrey-luthier.fr/data/Files/23351989015.pdf
http://4x4autok.hu/userfiles/files/sowepex.pdf
http://www.consorcio.edu.pe/wp-content/plugins/formcraft/file-upload/server/content/files/1606d50c330a41---tidasapifomuj.pdf
https://aradovan.com/userfiles/file/6358840019.pdf
http://chieusangducphat.com/uploads/userfiles/file/vojazinelarilikef.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

coretry.ru
aep-tc.com
chinalabware.ru
israel-aliya.com
imagespa.mx
careerhack.net
mavismanagement.com
cffcommunications.nl
mygotour.com
tenfci.org
macabrey-luthier.fr
aradovan.com
chieusangducphat.com
www.w3.org
purl.org
ns.adobe.com
thanhlamresort.vn
4x4autok.hu
www.consorcio.edu.pe

Embedded IP addresses

74.179.77.204
172.172.255.217
135.233.95.80
20.184.175.8
20.42.73.26
172.66.2.5
4.230.171.124
172.215.188.232
20.3.0.251
162.159.142.9
20.165.94.63
135.233.95.135
52.168.117.169
40.99.134.2
52.123.129.14
135.233.45.223
72.154.7.107
203.26.79.13
52.123.252.220
92.223.78.30
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report