MALICIOUS — cac0bd6531a4dcb30f95c40938927d0653b52a49ad4d0d75acc81f2f0d299b4f

MALICIOUS — cac0bd6531a4dcb30f95c40938927d0653b52a49ad4d0d75acc81f2f0d299b4f is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: cac0bd6531a4dcb30f95c40938927d0653b52a49ad4d0d75acc81f2f0d299b4f
SHA-1: 5b997de1d5b8a1f0d233d2db9b7138141ae5f26d
MD5: dc1339e0578a82b346bdced3aaf1c378
ssdeep: 1536:q+fSuLfTxNYRk9ioO9kdt82MsGbcM+GA5BuWvnEMEh5eZ3WspORLwXK3UNY:vKQQkjUc4sEcM+GA5PZmRLwXGP
TLSH: T1A039C0F3119BED5C7A8B8B4369F610EDA48ED7C86222F6804488756CC87C5BEBE10D41
Submitted as: cac0bd6531a4dcb30f95c40938927d0653b52a49ad4d0d75acc81f2f0d299b4f
File type: pdf · Size: 84626 bytes
Verdict: malicious (95/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 95/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 21 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://huntic.ru/uplcv?utm_term=samsung+yang+paling+canggih, http://strandedtattoo.net/file/4907563278.pdf, http://acetuitioncentre.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/16138492f3788b---ziluborixo.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9683 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\9b1cdc347cce0496a5775be4df0cfd55.png - a6723c2e300574e446d2a51d55ff81a55dad2bbb31b1b71500c22498e52da130
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 29f1b3541918448fd02a916c722c2850472d6ed0bab0b4314c7b2ab0403827ee
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://huntic.ru/uplcv?utm_term=samsung+yang+paling+canggih
http://strandedtattoo.net/file/4907563278.pdf
http://acetuitioncentre.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/16138492f3788b---ziluborixo.pdf
http://castrolmintabolt.hu/images/upload/file/bamibasupaxifobodo.pdf
http://esistore.com/userfiles/file/givokad.pdf
http://hyundaidongdo3s.com/images/files/1431630260.pdf
http://www.schule.havonix.com/ckfinder/userfiles/files/66131464568.pdf
http://centreforeffectivecoaching.com/media/file/latabebezivakedo.pdf
http://www.loicadesacavem.pt/wp-content/plugins/formcraft/file-upload/server/content/files/16143a2c629f5f---nunebogogabi.pdf
https://bodymason.com/user_uploads/files/45972214855.pdf
https://feng-shuiworld.com/userfiles/file/460691238.pdf
https://5of7edwardstreet.com/assets/media/files/63876214769.pdf
https://www.hauptsache.cc/wp-content/plugins/formcraft/file-upload/server/content/files/1614552ec1d85f---vudepin.pdf
https://moma-restaurant.com/wp-content/plugins/formcraft/file-upload/server/content/files/16139b3bde324d---bimoxufibemek.pdf
http://accessibilite-salle-eau.com/ckfinder/userfiles/files/zisuwow.pdf
http://trainternational.in/wp-content/plugins/formcraft/file-upload/server/content/files/16139a37d7b614---vezobibuzoza.pdf
http://albarossa.jp/js/upload/files/53871996983.pdf
http://pebyte.com/wp-content/plugins/super-forms/uploads/php/files/jqv7g9qpu5ogs2niuscfmr3i4o/luboto.pdf
http://idominjazz.com/fckeditor/userfiles/image/76325380613.pdf
https://interconformity.ro/images/file/jituxukowewu.pdf
http://www.linkkorea.co.kr/wp-content/plugins/formcraft/file-upload/server/content/files/161440a3f17b6e---38705081684.pdf
http://edbiji.com/uploads/files/20210917061200_100812.pdf
https://dafelia.com/files/kivazetulosovobib.pdf
http://asliev.coco1490.com/upload/file_folder/file/tesevorulazokelizezafovat.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

huntic.ru
strandedtattoo.net
acetuitioncentre.com.au
esistore.com
hyundaidongdo3s.com
www.schule.havonix.com
centreforeffectivecoaching.com
bodymason.com
feng-shuiworld.com
5of7edwardstreet.com
www.hauptsache.cc
moma-restaurant.com
accessibilite-salle-eau.com
trainternational.in
albarossa.jp
pebyte.com
idominjazz.com
www.linkkorea.co.kr
edbiji.com
dafelia.com
asliev.coco1490.com
www.w3.org
purl.org
ns.adobe.com
castrolmintabolt.hu

Embedded IP addresses

20.184.175.11
162.159.142.9
20.184.175.5
52.123.252.245
4.144.132.223
52.110.12.52
52.110.12.28
4.230.171.124
57.154.63.210
74.178.76.44
203.26.79.13
74.179.77.204
74.179.77.164
74.178.240.61
40.103.64.242
52.123.128.14
135.233.45.221
57.155.101.212
20.50.73.14
13.69.116.104
20.184.175.18

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report