MALICIOUS — c95b8fb0afecdf4337cbb3fa02c4d33722d39463235033bc92e55dbd25bea919

MALICIOUS — c95b8fb0afecdf4337cbb3fa02c4d33722d39463235033bc92e55dbd25bea919 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: c95b8fb0afecdf4337cbb3fa02c4d33722d39463235033bc92e55dbd25bea919
SHA-1: 4869d127ce138f2b8e1d3a3bad6c4f05804d92f0
MD5: ebbd4b70fd34e39e191d4b00d45d09b4
ssdeep: 1536:yreicuUYcyiSCiYDV7KOvYg9Snsp1cSPjb4LxXzVHxyNEp4wc5mgybDP+pGbxb7K:++5YcyijDZ56nsp1cA4LxXdAN24Cg+DQ
TLSH: T1AF39D1F35183EE8CB9456F63AAEB1554B048C34C9532DB910988BB2DC43C7DE7E509A2
Submitted as: c95b8fb0afecdf4337cbb3fa02c4d33722d39463235033bc92e55dbd25bea919
File type: pdf · Size: 89298 bytes
Verdict: malicious (98/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!EBBD4B70FD34
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4464080/normal_6006e2da3137c.pdf - network signal, weight 0.70, confidence 0.80
Contacted 23 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://bologen.ru/award?keyword=promissory+note+for+loan+pdf, http://kekijojovif.sportsontheweb.net/zisijebekesoxive.pdf, http://dobofozepop.mygamesonline.org/fudge_a_mania_free_download.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9701 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
desktop-hsgcbep._dosvc._tcp.local
desktop-hsgcbep(1)._dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 8e4b95965af338391d200c0659aa14511be66c0af57f33cff38d2e285748a519
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\1ca306fa8f3b632d09bf529bbad0e609.png - a57601709b1ed277ea70db9b5260f6f03be1df5d481f9cd09f43e87d874c3279
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://bologen.ru/award?keyword=promissory+note+for+loan+pdf
http://kekijojovif.sportsontheweb.net/zisijebekesoxive.pdf
http://dobofozepop.mygamesonline.org/fudge_a_mania_free_download.pdf
http://civiliscmq.online/75878414290ctdwt.pdf
https://cdn-cms.f-static.net/uploads/4413458/normal_603239cb8e976.pdf
https://static.s123-cdn-static.com/uploads/4464080/normal_6006e2da3137c.pdf
https://cdn-cms.f-static.net/uploads/4391920/normal_5fe67861c45eb.pdf
http://wide-mean.top/what_subjects_do_you_need_to_be_a_marketing_manager39bo3.pdf
https://cdn-cms.f-static.net/uploads/4366024/normal_6017be63b9451.pdf
https://uploads.strikinglycdn.com/files/d598b81f-8453-4e22-b631-412e5ff3c668/sunijukitejokevovutexuxe.pdf
https://cdn-cms.f-static.net/uploads/4366341/normal_5fd652b1b9eed.pdf
http://pornbustyvids.com/bicentennial_man_piano_sheet_musice6hiv.pdf
https://cdn-cms.f-static.net/uploads/4472186/normal_603030809d93b.pdf
https://uploads.strikinglycdn.com/files/c2759f18-b0e7-400c-ba7e-4aa20e415706/8249276920.pdf
https://static.s123-cdn-static.com/uploads/4377113/normal_5ffe880c71731.pdf
http://dosubodanes.mypressonline.com/3365691711.pdf
http://figimumagoko.mygamesonline.org/turn_off_stability_control_jeep_jk.pdf
https://static.s123-cdn-static.com/uploads/4414491/normal_5fc609c70ea3d.pdf
http://carishr.com/83548647952k91xb.pdf
https://uploads.strikinglycdn.com/files/be4abc8b-4a83-4b51-ad0a-2abe5100048e/jbl_flip_3_battery_life_problem.pdf
http://gisoboxizaza.mygamesonline.org/clayden_organic_chemistry_archive.pdf
http://jovepodixowofow.mygamesonline.org/resasarisumibexuwiwikeb.pdf
https://cdn-cms.f-static.net/uploads/4468274/normal_602baa15e5e0a.pdf
http://plsale.pro/firobafijubavutamepefilajab.pdf
http://rivetibixonapaz.myartsonline.com/zotalo.pdf

Embedded domains

bologen.ru
kekijojovif.sportsontheweb.net
dobofozepop.mygamesonline.org
civiliscmq.online
cdn-cms.f-static.net
static.s123-cdn-static.com
wide-mean.top
uploads.strikinglycdn.com
pornbustyvids.com
dosubodanes.mypressonline.com
figimumagoko.mygamesonline.org
carishr.com
gisoboxizaza.mygamesonline.org
jovepodixowofow.mygamesonline.org
plsale.pro
rivetibixonapaz.myartsonline.com
xadazobisisim.scienceontheweb.net
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

20.42.179.204
203.26.79.13
57.155.104.224
172.172.255.218
172.172.255.217
162.159.142.9
20.50.201.200
52.110.12.46
172.215.188.225
4.230.171.124
4.144.132.223
52.123.252.235
4.207.44.73
74.178.76.128
20.76.201.171
20.165.94.63
40.99.133.242
52.123.129.14
52.123.252.241
74.179.71.159
20.89.1.10
13.69.109.131
52.168.117.168

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report