MALICIOUS — 44816869226.pdf

MALICIOUS — 44816869226.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 50 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: ca4878937068fb302c8e149ee5155cd1134d59dd8115f45fa010299fd5acf24d
SHA-1: 4375c4031b924c2f4714808a0a70ae9e5dcae222
MD5: 4be21e49f4cf88de0b59cd4e96b8ede8
ssdeep: 3072:p4m1KLFGF9HHmK1VwcHtnExqN5NpgZyR7ju:pbgYFtH/wcHtEcHNy
TLSH: T1783AD1F32153DD0CBB835B43A9E651685085F38D21A1AE70859CBA9CC8FC5BDBF10661
Submitted as: 44816869226.pdf
File type: pdf · Size: 99515 bytes
Verdict: malicious (99/100)

Detections (4 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
Emsisoft (Emergency Kit): PDF.Spam.Heur.1

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Lazarus): root_.cache_dconf_user - dynamic signal, weight 0.80, confidence 0.90
Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 34 external host(s) at runtime (5 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://gramercy-grand.ru/files/file/43358506818.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://webupdate.ca/wp-content/plugins/super-forms/uploads/php/files/o24u27tmpt58n7ef1cak0cn5lk/lebimakitojetapizatej.pdf, http://khaskhaan.mn/uploads/userfiles/files/64217466951.pdf, https://alwillislifecenter.org/ckfinder/userfiles/files/65497909747.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9742 behavior events · 1 ATT&CK techniques · 4 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
desktop-hsgcbep
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

/opt/CAPEv2/storage/analyses/27529/files/1f7d8979e682d7623b2acda3e71251c80515f67ba95598e6e21d5e321bf6103c - 1f7d8979e682d7623b2acda3e71251c80515f67ba95598e6e21d5e321bf6103c
/opt/CAPEv2/storage/analyses/27529/files/0aec23b06029bd23a3c5fd0cfa737c3ed0c76e59e0f54949141631df2506e39f - 0aec23b06029bd23a3c5fd0cfa737c3ed0c76e59e0f54949141631df2506e39f
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
tmp_tmp.Wil6fphMpf - 7346108d3eafe38b15bd61186c13bb256c861a8193f2c29625c5bbcf57b97f83

Embedded URLs

https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/DOqCt-cVA4I/uplcv?utm_term=discrete+math+workbook+interactive+exercises+pdf
https://webupdate.ca/wp-content/plugins/super-forms/uploads/php/files/o24u27tmpt58n7ef1cak0cn5lk/lebimakitojetapizatej.pdf
http://khaskhaan.mn/uploads/userfiles/files/64217466951.pdf
https://alwillislifecenter.org/ckfinder/userfiles/files/65497909747.pdf
https://brusroom.com/wp-content/plugins/super-forms/uploads/php/files/c8dc85bf55aa3202fe3d73ec3f89b778/pogimabokox.pdf
https://unique.global/wp-content/plugins/super-forms/uploads/php/files/7dd74445ba9d72ed6a60c15a6e229258/kawuzobisumota.pdf
http://otvorene-srdce.sk/userfiles/file/2942230643.pdf
http://gramercy-grand.ru/files/file/43358506818.pdf
http://ophtalmic-overnight.fr/wp-content/plugins/formcraft/file-upload/server/content/files/1607108c8e6729---31157273726.pdf
http://www.patricktennis.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160ccf2e49326a---96739719119.pdf
http://losmarinoslanzarote.com/marinarubicon/admin/file/rewewilarapapukan.pdf
https://himalayanthailand.com/image/upload/File/59432553404.pdf
http://acecaalcoy.com/userfiles/file/lidaxifijosafig.pdf
https://deewo.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607053b4306ff---22629893287.pdf
http://sipzip.com/userfiles/file/36245761954.pdf
http://vp-dmsh.ru/admin/ckfinder/userfiles/files/rojazujusufagajix.pdf
http://www.iqubz.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a728abafb51---7929820766.pdf
https://ideylia.fr/uploads/file/2366335181.pdf
https://dentinale.eu/wp-content/plugins/super-forms/uploads/php/files/0000b7cb65ea5c584ad0307cf0358e6a/13928626644.pdf
https://autoteam.in/ckfinder/userfiles/files/rupotarokewokarigo.pdf
http://gancza.pl/userfiles/file/22413246299.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/

Embedded domains

feedproxy.google.com
webupdate.ca
alwillislifecenter.org
brusroom.com
gramercy-grand.ru
ophtalmic-overnight.fr
www.patricktennis.nl
losmarinoslanzarote.com
himalayanthailand.com
acecaalcoy.com
deewo.de
sipzip.com
vp-dmsh.ru
www.iqubz.com
ideylia.fr
dentinale.eu
autoteam.in
gancza.pl
www.w3.org
purl.org
ns.adobe.com
khaskhaan.mn
unique.global
otvorene-srdce.sk

Embedded IP addresses

34.160.111.145
135.233.95.144
135.234.160.245
74.179.71.159
52.182.141.63
4.144.132.223
52.110.12.33
4.230.171.124
20.112.250.133
51.116.246.104
52.123.128.14
20.165.94.46
72.154.7.97
203.26.79.13
52.148.114.188
162.159.36.2

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report