MALICIOUS — ccdb025dca3cf51d3c11f53b18a41ba18f25b394bda2b4c3f00acee097dddc80

MALICIOUS — ccdb025dca3cf51d3c11f53b18a41ba18f25b394bda2b4c3f00acee097dddc80 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: ccdb025dca3cf51d3c11f53b18a41ba18f25b394bda2b4c3f00acee097dddc80
SHA-1: 719515a2b3ce2e6c784700d96b2ab09cccd34694
MD5: 8d6e9361952046a3ced6ea3ec3c08f95
ssdeep: 1536:P66JRWCENxkIDLHh5GEFpFIpd1ywZjW6pOu26W0OpH0ZZ3z5qb6ZRk5s:SydEAIDTfGEez1FZou2KqcN5qCRj
TLSH: T19D38C0F3609BDD4C775A8F0366FA12499489D3CC1266FB518488B66C947CAFEBE00721
Submitted as: ccdb025dca3cf51d3c11f53b18a41ba18f25b394bda2b4c3f00acee097dddc80
File type: pdf · Size: 77560 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://abovomedia.hu/_user/file/puwegujokis.pdf - network signal, weight 0.70, confidence 0.80
Contacted 17 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://anhuizpyy.com/upload_fck/file/2021-10-7/20211007025439913586.pdf, http://xn--5dbfbdrd7azav1bcx.com/sites/default/files/file/dipubuwuwuw.pdf, http://grandviewgroupresort.com/upload/files/bavizepofugu.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9707 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
_dosvc._tcp.local
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787910640&P2=404&P3=2&P4=LX4DwHc4qm%2focLWgGMFYBbCRmOjf10FDbz0v2BYoRvLAJAzfzVKkPnn3BMmUd7D2ObGiU%2biJr3v%2fkd0rcf66vQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787910709&P2=404&P3=2&P4=fx2y8uJSvXLrMfnLahWvBplpTRSSPCorZsxGQRUyoKHBSGGCpF9z716BOFBx3W65Qnh15nA6DG9O4ef58JhwLQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\c86838faf901801f2f1267b563896b09.png - b3d2eb2d051a55f11fb05b357abc744f45a9639496ef8832a3ef184e44f63fcc
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - a57173bd8fa8e472b84948f946399888e26c1c49eac8705a9f7b887b9191e62f
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

http://feedproxy.google.com/~r/MbOu/~3/6Zflnl449io/uplcv?utm_term=nick+and+gs
http://anhuizpyy.com/upload_fck/file/2021-10-7/20211007025439913586.pdf
http://xn--5dbfbdrd7azav1bcx.com/sites/default/files/file/dipubuwuwuw.pdf
http://grandviewgroupresort.com/upload/files/bavizepofugu.pdf
http://paradisoseminatrici.it/userfiles/files/givixebutatuwivivutikilig.pdf
http://abovomedia.hu/_user/file/puwegujokis.pdf
http://spreewaldpension-luebben.de/meineBilderAlbertGrundschule/file/35027899379.pdf
https://vmwarts.com/ecovic/file/fimelofidiferajuw.pdf
http://beautybybelief.com/admin/images/file/wejawitowi.pdf
https://capitolmodels.tuzonanet.net/userfiles/file/56161045271.pdf
http://csc-0411.com/userfiles/file/20211001025656_ilbt9c.pdf
http://thechelseaff.com/user_uploads/files/74702500792.pdf
http://www.lalorraineperdue.com/documents/60597265266.pdf
http://officeharbor.com/pdtInfo/71326473296.pdf
http://gorod-r.com/userfiles/file/56756272147.pdf
http://alnadaoil.com/userfiles/file/sijusu.pdf
http://superazs.ru/images/news/file/50156755929.pdf
https://www.gurgy.net/ckfinder/userfiles/files/kejafalilixixuwoto.pdf
http://socukorglutamatmentesfuszer.hu/ckfinder/userfiles/files/rokasusebazutigopakiz.pdf
http://soojuspilt.ee/files/file/wexunug.pdf
http://chikatere.com/Upload/files/56987635563.pdf
http://yey.uw52.com/upload/files/besezazarebibapofo.pdf
http://vasekurzy.cz/userfiles/file/gifikipetexu.pdf
http://wxmx.cn/upload/ckimg/files/202109060835374588.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

feedproxy.google.com
anhuizpyy.com
xn--5dbfbdrd7azav1bcx.com
grandviewgroupresort.com
paradisoseminatrici.it
spreewaldpension-luebben.de
vmwarts.com
beautybybelief.com
capitolmodels.tuzonanet.net
csc-0411.com
thechelseaff.com
www.lalorraineperdue.com
officeharbor.com
gorod-r.com
alnadaoil.com
superazs.ru
www.gurgy.net
chikatere.com
yey.uw52.com
wxmx.cn
www.w3.org
purl.org
ns.adobe.com
abovomedia.hu
socukorglutamatmentesfuszer.hu

Embedded IP addresses

20.42.179.204
48.211.4.16
20.42.65.84
52.123.252.245
52.110.12.52
52.110.12.37
4.230.171.124
135.232.92.34
203.26.79.13
74.178.240.51
20.231.239.246
52.123.128.14
40.103.64.226
74.179.77.204
92.223.78.30
20.184.175.22
51.132.193.105

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report