MALICIOUS — 20210907081802.pdf

MALICIOUS — 20210907081802.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: cec5f89e47d7102fdfb62302a056ee71a573681ab694c7505f750093c233ae39
SHA-1: 2f7d03b1306b2b2aa7c6a598910777d2d2a62aed
MD5: 6e55be92db6305abd3e0b80814e5d632
ssdeep: 1536:Iqfx0b3Uz5QmZqBqhz/PvWiWZmMrSUP8Mt6IfWy0Kcl/pA/wWspORqsc:/fx1l/0B0L2cMeUP8tIJyly/LRk
TLSH: T1DB39D0F32197CC9CB697CB03697782586086F7C5B122DBA54088B3BCCA7C9BD5B18941
Submitted as: 20210907081802.pdf
File type: pdf · Size: 86174 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://insuralead.com/userfiles/file/20720298370.pdf - network signal, weight 0.70, confidence 0.80
Contacted 16 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://104.156.58.56/~web2inbox/wp-content/plugins/formcraft/file-upload/server/content/files/160b41fa55b5d7---todovogimavejigutul.pdf, http://insuralead.com/userfiles/file/20720298370.pdf, https://chicagoportablexray.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a0544e47c7c---gubizepilalununalobirad.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9739 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787776018&P2=404&P3=2&P4=apPIink2tKy78lN30WH2dF2x70Vxsi8ONpxe13Ut5QX9WR158url5rMm%2bQ8k4%2b7vBLDGL3nWf23%2fCsc1a3c9PA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787776056&P2=404&P3=2&P4=e9qTBGUrF4VhZOmAp8mpzA652jkds1Tl4PXO2F5F%2fY2FDRyVgP5hEjPJGg%2bMXTsHOalTldVU6UkdV81%2br04Adw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\b9b5c196ae030a28117993123e5b304e.png - a2544c73002cd982ad5847604724d103cf6259f1221bfc8e83a32fea584de5b7
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 02cae9e8d06643f7fd3469ac736c36d594b229ff6029ecefb16ca94c88d6bab9
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/Om9ozkHLxGw/uplcv?utm_term=2015+bmw+x1+xdrive28i+owners+manual
http://104.156.58.56/~web2inbox/wp-content/plugins/formcraft/file-upload/server/content/files/160b41fa55b5d7---todovogimavejigutul.pdf
http://insuralead.com/userfiles/file/20720298370.pdf
https://chicagoportablexray.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a0544e47c7c---gubizepilalununalobirad.pdf
http://kazenergy.kz/wp-content/plugins/formcraft/file-upload/server/content/files/160aea58a067f6---patebozoboto.pdf
https://weborder.cloud/userfiles/file///32484079671.pdf
http://pinzimoniofiumicino.eu/userfiles/files/laviketezafazitim.pdf
http://gruppocaminiti.it/userfiles/files/75412588751.pdf
https://stpetejazz.com/wp-content/plugins/super-forms/uploads/php/files/2iu29k40nhv770vtindg7qu5f9/sifipikedasilo.pdf
http://www.rolstoellift.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608d33a4d5275---26941206882.pdf
http://songhakbbq.com/uploads/files/wovonapuzaj.pdf
http://slovbau.sk/test/userfiles/file/xekavegarojoregogor.pdf
http://christopherspubandgrille.com/userfiles/files/6619710153.pdf
https://yourlightingbrand.com/wp-content/plugins/super-forms/uploads/php/files/2c8cd8dc9134d3bef984a6bd57a63bef/27187358360.pdf
http://isystem.hu/userfiles/file/55320011586.pdf
http://saopauloairporttransfers.com/ckfinder/userfiles/files/darogumikelu.pdf
http://teechart.com/uploads/images/files/57830378727.pdf
http://www.hypnotiseur.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a1324182b32---xuwokutarogexekidu.pdf
http://crmloccitanecr.com/campannas/file/tetexoxodotuxiwi.pdf
https://korvioinfotech.com/ckfinder/userfiles/files/mabokumisuf.pdf
http://osullivanspressurewashing.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a5bcdbad20e---xixonefopasarasukur.pdf
http://tootingtaxi.com/survey/userfiles/files/zutanofi.pdf
http://ingmarcofaedi.com/userfiles/files/37619624574.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/

Embedded domains

feedproxy.google.com
insuralead.com
chicagoportablexray.com
weborder.cloud
pinzimoniofiumicino.eu
gruppocaminiti.it
stpetejazz.com
www.rolstoellift.com
songhakbbq.com
christopherspubandgrille.com
yourlightingbrand.com
saopauloairporttransfers.com
teechart.com
www.hypnotiseur.com
crmloccitanecr.com
korvioinfotech.com
osullivanspressurewashing.com
tootingtaxi.com
ingmarcofaedi.com
www.w3.org
purl.org
ns.adobe.com
kazenergy.kz
slovbau.sk
isystem.hu

Embedded IP addresses

104.156.58.56
20.42.179.204
52.230.60.54
52.110.12.51
52.110.12.30
4.230.171.124
203.26.79.13
20.165.94.54
40.99.133.226
20.165.94.63
20.42.73.31
135.233.95.80
172.66.2.5
142.250.183.35
20.42.73.27
48.192.143.121
142.251.42.99

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report