MALICIOUS — bukoviwalafevupedet.pdf

MALICIOUS — bukoviwalafevupedet.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 50 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: caba32727897fe54aab259659524e5cda7fab72a87ee9c1eb21860cac3efc7da
SHA-1: 47b71cfa07822c5e9a946518ed35f8d2c5cd4718
MD5: 37dd7e17bf1252997a72c49fc4c4c818
ssdeep: 1536:Dpp4J7nxxQHH63HHD/NXlnRqqGZOW6pOu26Wne3WZFeEGJ+3h:v4tzQHa3nLjRqpu27iJC
TLSH: T18D37C0F311C7DD8C7A97CF0369EA62689047D7486272EB948488A67CD5BC67D7E08E00
Submitted as: bukoviwalafevupedet.pdf
File type: pdf · Size: 71810 bytes
Verdict: malicious (99/100)

Detections (4 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
Emsisoft (Emergency Kit): PDF.Spam.Heur.1

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Lazarus): root_.cache_dconf_user - dynamic signal, weight 0.80, confidence 0.90
Contacted 34 external host(s) at runtime (3 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://www.grundys.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/16127086d4d556---zodelidawasibo.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://garglob.ru/uplcv?utm_term=input+file+only+pdf+and+doc, http://bygreenpure.com/userfiles/file/benexewapetexidatimaxan.pdf, https://sancarspune.com/wp-content/plugins/super-forms/uploads/php/files/46436b16af43109f3d4751e130366be0/tubewugaxutelakugilewo.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9594 behavior events · 1 ATT&CK techniques · 4 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
searchapp.bundleassets.example
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
250.255.255.239.in-addr.arpa
desktop-hsgcbep
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
23.40.52.85

Dropped files

/opt/CAPEv2/storage/analyses/26896/files/aaff0124b4d0954f9d56c164a82d3cdeaec9cb3ead3038475dec86ab7a503436 - aaff0124b4d0954f9d56c164a82d3cdeaec9cb3ead3038475dec86ab7a503436
/opt/CAPEv2/storage/analyses/26896/files/b0a5ae4edf3eb21b1f25f173685de1d045b731226525b1f4905924e389e18b18 - b0a5ae4edf3eb21b1f25f173685de1d045b731226525b1f4905924e389e18b18
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
tmp_tmp.LCP4Su7XsG - 258b1ed3329fd9b46d4524b41db728f33dc6ff320bb41eb0493b8af476daded8

Embedded URLs

https://garglob.ru/uplcv?utm_term=input+file+only+pdf+and+doc
http://bygreenpure.com/userfiles/file/benexewapetexidatimaxan.pdf
https://sancarspune.com/wp-content/plugins/super-forms/uploads/php/files/46436b16af43109f3d4751e130366be0/tubewugaxutelakugilewo.pdf
http://nessium.fr/userfiles/file/66610115526.pdf
http://www.grundys.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/16127086d4d556---zodelidawasibo.pdf
https://zegaoyun.com/calisma2/files/uploads/75486632501.pdf
http://stensoproject.com/userfiles/files/58141224317.pdf
http://ccspatti.org/userfiles/file/31652472714.pdf
http://www.peopleoftheheath.com/wp-content/plugins/formcraft/file-upload/server/content/files/160f0978017b2e---42807246469.pdf
https://seroinstitute.com/wp-content/plugins/super-forms/uploads/php/files/2ede218c2ed2e61a9460e234e1c25eb0/vamubepoxuga.pdf
http://pvvc.cz/files/judisexenu.pdf
http://alphamarino.kz/images/news/file/42000403044.pdf
https://nationalcardsolutions.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608a4e24f2240---mokatibezomep.pdf
https://die-elke.de/cms/elke_page_files/file/22852699232.pdf
https://harom.ro/files/file/15645200912.pdf
http://www.investinwielkopolska.pl/application/lib/ckfinder/userfiles/files/vusefifemiwup.pdf
https://scanclean.bg/upload/ckfinder/files/rolabibajixutijazivoselop.pdf
http://boulderdivorcelaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607b1c44adc06---soxenulixirelunajuwum.pdf
https://brusroom.com/wp-content/plugins/super-forms/uploads/php/files/d9f34a93ee69ccc8ab373e0d91330a60/54277432624.pdf
http://labonscafe.com/userfiles/garalelex.pdf
https://turkuazhost.com/calisma2/files/uploads/togetanevizenanano.pdf
http://cropscipublisher.com/files/upfiles/file/defoxosoviwofelexux.pdf
https://www.psalighting.com/wp-content/plugins/super-forms/uploads/php/files/31dc28b477919690666fc7382e037fdd/45445990577.pdf
http://bolshunoff.ru/images/wysiwyg/file/gedexinijivinofile.pdf
http://mirandatutoringcentre.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160b3b7dc27082---67865416293.pdf

Embedded domains

garglob.ru
bygreenpure.com
sancarspune.com
nessium.fr
www.grundys.com.au
zegaoyun.com
stensoproject.com
ccspatti.org
www.peopleoftheheath.com
seroinstitute.com
nationalcardsolutions.com
die-elke.de
www.investinwielkopolska.pl
boulderdivorcelaw.com
brusroom.com
labonscafe.com
turkuazhost.com
cropscipublisher.com
www.psalighting.com
bolshunoff.ru
mirandatutoringcentre.com.au
www.w3.org
purl.org
ns.adobe.com
pvvc.cz

Embedded IP addresses

4.150.223.100
20.165.94.63
172.172.255.218
4.150.223.103
52.123.252.192
52.110.12.28
85.210.196.11
4.230.171.124
52.110.12.25
74.178.240.61
135.232.92.137
20.247.185.124
52.123.252.227
20.231.239.246
40.99.133.226
72.153.5.134
52.123.128.14

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report