MALICIOUS — cfbe78b6dd534abae1589799329fc62dd40e7a36f6b54f5e7958ca6c1735e72a

MALICIOUS — cfbe78b6dd534abae1589799329fc62dd40e7a36f6b54f5e7958ca6c1735e72a is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: cfbe78b6dd534abae1589799329fc62dd40e7a36f6b54f5e7958ca6c1735e72a
SHA-1: 58c5b7403e73b8e624881888c77da2434bd03c09
MD5: 9e88b30193f2dd6c261e30565705b6a2
ssdeep: 1536:qUmz4YRoWPSXS54Jqh9XrHWsCn54RXXiAVsIBU7YIWHnqFm3uSO23MaxLWApO6ke:ZmzDbKUXXrvCwxVsRk6Q3uSO23Rxa6d
TLSH: T19539CFF722A7DD8C3B4B9B4335F716A87486C2883171E5A005847A7C96B86FEAF14601
Submitted as: cfbe78b6dd534abae1589799329fc62dd40e7a36f6b54f5e7958ca6c1735e72a
File type: pdf · Size: 87295 bytes
Verdict: malicious (95/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 95/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 17 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://candientushinko.com/images/file/mevilusirijitafubolevinuf.pdf, http://nuovartea.eu/userfiles/files/71795366600.pdf, http://stsmcc.org/www/js/ckfinder/userfiles/files/luwuja.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9679 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
_dosvc._tcp.local
desktop-hsgcbep._dosvc._tcp.local
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
desktop-hsgcbep
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787828768&P2=404&P3=2&P4=VTmMNEa0%2bLuJQ4b7zlaQtAvTtUPA%2fzxUDtKauMtBBJNeddFJtLnaJZ89zSOR7%2bA%2b6sn0JlNzSD3UmdabLliRjA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\06340fac54fa4d6c2a17304265525a40.png - f1367fded52fdcd4140262f1eed58bb05a6e07017f6b8bb0a71e56ee5d650182
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 7cc20c900c0b8a8719485d8119607e349a65c99b2fe5eceede207651824b55b5
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/1xuhb7AK25c/uplcv?utm_term=sausage+toad+for+2
http://candientushinko.com/images/file/mevilusirijitafubolevinuf.pdf
http://nuovartea.eu/userfiles/files/71795366600.pdf
http://stsmcc.org/www/js/ckfinder/userfiles/files/luwuja.pdf
http://arabic.cz/ckfinder/userfiles/files/56275113274.pdf
https://www.kadinlarsitesi.org/wp-content/plugins/formcraft/file-upload/server/content/files/1614bbe1ba471a---bamevobetuviwupabipave.pdf
http://artpolyclinic.com/file/files/jirurorovupakiw.pdf
https://quatden.vn/webroot/img/files/muzapegagoxirutirexemidum.pdf
http://picassogift.com/Uploadfiles/files/74121462345.pdf
http://aktifbant.com/resimler/files/23522221948.pdf
https://treasurehunterdetectors.com/ckfinder/userfiles/files/gaboridonul.pdf
http://proart.by/media/file/9479629184.pdf
http://373113.linker.tw/files/93744908402.pdf
http://devison-matras.com/upload/file/67498216914.pdf
https://habibitours.org/ckfinder/userfiles/files/37886771373.pdf
http://hit-air.pro/ckfinder/userfiles/files/73864251254.pdf
http://alliance-ic.ru/uploads/file/rafafa.pdf
http://www.kocay.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/161383a3a3625c---33652710903.pdf
https://rffsev.ru/wp-content/plugins/super-forms/uploads/php/files/d12b5e5c217021359a48bbae8c2fd956/mesegetigijokixiweb.pdf
http://biosurfest.com/userfiles/files/10694571200.pdf
http://petgears.com/app/webroot/files/file/bexutorujuwejesud.pdf
http://hongsung114.com/files/fckeditor/file/14069874493.pdf
http://raffaelecavazzoni.com/userfiles/files/33336428076.pdf
http://theopenhouseclub.com/wp-content/plugins/super-forms/uploads/php/files/cf23b1dbc17d1f1de194ff66ae6eb134/bagufe.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

feedproxy.google.com
candientushinko.com
nuovartea.eu
stsmcc.org
www.kadinlarsitesi.org
artpolyclinic.com
picassogift.com
aktifbant.com
treasurehunterdetectors.com
373113.linker.tw
devison-matras.com
habibitours.org
hit-air.pro
alliance-ic.ru
rffsev.ru
biosurfest.com
petgears.com
hongsung114.com
raffaelecavazzoni.com
theopenhouseclub.com
www.w3.org
purl.org
ns.adobe.com
arabic.cz
quatden.vn

Embedded IP addresses

172.172.255.218
4.150.223.114
85.210.196.11
172.66.2.5
4.230.171.124
20.247.184.197
20.165.94.63
52.123.128.14
52.123.129.14
40.99.133.242
40.103.64.226
72.145.35.107
203.26.79.13
135.233.45.222
48.199.12.1
52.148.114.188
162.159.142.9

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report