MALICIOUS — c9b5147e2304864dd86045a47c54789befff60d32d10a4300a75bf8b46df16bd

MALICIOUS — c9b5147e2304864dd86045a47c54789befff60d32d10a4300a75bf8b46df16bd is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: c9b5147e2304864dd86045a47c54789befff60d32d10a4300a75bf8b46df16bd
SHA-1: 7e3479a0e71bec0a1d885d46e01d965cb1344c26
MD5: 7132d3b6bbba895c4128ab402f9b6100
ssdeep: 1536:yQfN6ZQjJtaLA9jBIhYxyFNDNltKAaYuoelx6WHay5BWspO2cwu:FfNPGLA9uIyFNDNlnTlelx5n5w2E
TLSH: T16D39D1F720A7DC8CB7CD8B87E9EA019C5589D7C87462AB62458C7A2C947CA7D3F00950
Submitted as: c9b5147e2304864dd86045a47c54789befff60d32d10a4300a75bf8b46df16bd
File type: pdf · Size: 84417 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://musicandyouapp.com/webupload/editorimg/files/86749721374.pdf - network signal, weight 0.70, confidence 0.80
Contacted 18 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://drafthe.ru/uplcv?utm_term=altons+finest+chimney+sweep, http://hongshengfish.com/uploadfiles/2021091408495085001.pdf, http://radio-salsa.com/php/rs/filesupload/file/698325792.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9668 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
_dosvc._tcp.local
ntp.ubuntu.com
desktop-hsgcbep
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 3725a51ccdaff45a88a70bf5d4926662948b9a3cdcfd29a4458132060b580b45
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\a26082145af67c80608e7c9f5af010d7.png - c8743b11d12006fa92576518b39aaa0fc06fa02b583a2c2b1135f6967a4f4c77
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://drafthe.ru/uplcv?utm_term=altons+finest+chimney+sweep
http://hongshengfish.com/uploadfiles/2021091408495085001.pdf
http://radio-salsa.com/php/rs/filesupload/file/698325792.pdf
http://musicandyouapp.com/webupload/editorimg/files/86749721374.pdf
https://vzduchotechnickefiltry.cz/docs/21089247279.pdf
https://poolpoint.be/uploads/file/jimivaxobovesita.pdf
https://egc.ecrom.work/syo/files/gonuzogorisufo.pdf
https://plewmal-d.com/Uploads/files/lawekutaxojede.pdf
https://braviengenharia.com.br/wp-content/plugins/super-forms/uploads/php/files/0r1t6fl69e44ppll3hg2v3rs8b/64863872546.pdf
https://qigoodteam.com/uploads/files/202110011244583510.pdf
http://anthonyjcincottalaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/lomuzamipebejonobuna.pdf
http://bigbulkbags.com/survey/userfiles/files/tikepokogusobe.pdf
https://aljazeerahdrilling.com/userfiles/files/75796182039.pdf
https://asiahealthcaredentalcentre.com/ckfinder/userfiles/files/gosixawitijavafebewo.pdf
http://claudiodauelsberg.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1613487b8de0ba---jawonusolig.pdf
https://mosoptagro.ru/wp-content/plugins/super-forms/uploads/php/files/8b6c127323601bf4994c935f29bb3909/10264831605.pdf
http://avtrak.ru/ckfinder/userfiles/files/94731556996.pdf
https://drmiamiconnect.com/wp-content/plugins/super-forms/uploads/php/files/0b804ae097e250aabab6a7f456021110/gidapi.pdf
https://cualuoihoanmy.com/uploads/userfiles/file/zawoxagiruduv.pdf
http://sake2metustin.com/uploads/files/56573379396.pdf
http://robwalker.net/fckupload/file/susoluseworunakaxusol.pdf
http://delannahotel.com/user_img/file/25146975676.pdf
http://www.champcaregivers.com/wp-content/plugins/formcraft/file-upload/server/content/files/1615146377a729---99176741915.pdf
http://srs-budapest.hu/uploads/files/36324030231.pdf
https://matagujrischool.com/admin/imagetemp1/file/gibudopumez.pdf

Embedded domains

drafthe.ru
hongshengfish.com
radio-salsa.com
musicandyouapp.com
poolpoint.be
egc.ecrom.work
plewmal-d.com
braviengenharia.com.br
qigoodteam.com
anthonyjcincottalaw.com
bigbulkbags.com
aljazeerahdrilling.com
asiahealthcaredentalcentre.com
claudiodauelsberg.com.br
mosoptagro.ru
avtrak.ru
drmiamiconnect.com
cualuoihoanmy.com
sake2metustin.com
robwalker.net
delannahotel.com
www.champcaregivers.com
matagujrischool.com
www.w3.org
purl.org

Embedded IP addresses

4.247.188.233
51.116.253.169
48.211.4.16
20.184.175.15
74.179.71.159
52.110.12.22
4.230.171.124
72.153.5.129
203.26.79.13
135.232.92.97
20.231.239.246
20.165.94.63
52.123.128.14
92.223.78.30
48.192.143.121
40.79.141.155
4.150.223.113
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report