MALICIOUS — d0b61361ac5ce658253b6c9357e4421d6cc2fb656498e531322f166acd7d93ca

MALICIOUS — d0b61361ac5ce658253b6c9357e4421d6cc2fb656498e531322f166acd7d93ca is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (72/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: d0b61361ac5ce658253b6c9357e4421d6cc2fb656498e531322f166acd7d93ca
• SHA-1: 8fb04a30a93eb35d85000c72bf94b2641bc2a8a0
• MD5: 76034535bb88f2a3f42dd7e042df4b96
• ssdeep: 768:fh03I4Yisv6ZRBn63bHzqUm809Yf8bcRmTUp4DIZdf57CdvMq:AIXisABuuUvVffmUp4EgFn
• TLSH: T176329DF7415BCD0C658A9B139CB6115D69C9E388B432CB5095E8B73CC02DEFCB950A62
• Submitted as: d0b61361ac5ce658253b6c9357e4421d6cc2fb656498e531322f166acd7d93ca
• File type: pdf · Size: 46325 bytes
• Verdict: malicious (72/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: Trojan:PDF/Phish.CFN!MTB
• Emsisoft (Emergency Kit): PDF.Spam.Heur.2
• Trellix Stinger (McAfee): PDF/Phish-TWM!76034535BB88
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1105
• T1566.002

Why this verdict

The malicious score of 72/100 is the fusion of 6 weighted signals:

• Contacted 15 external host(s) and 8 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Embedded link rated suspicious by URL analysis: http://perpustakaan.pn-tapaktuan.go.id/repository/coin-master-card-collection-hack_GM406889139.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://netcdn.online/app/431946152/what-games-on-roblox-give-you-free-robux-game-hack, http://perpustakaan.pn-tapaktuan.go.id/repository/coin-master-card-collection-hack_GM406889139.pdf, http://perpustakaan.pn-tapaktuan.go.id/repository/best-free-minecraft-skins_GM479516143.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9725 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• ntp.ubuntu.com
• 250.255.255.239.in-addr.arpa
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787948767&P2=404&P3=2&P4=EDrQKZDdYuSrZ77hN0XD6CDJFiDc6onlauBRoyaNyy8rC%2fQUc%2fZ3kpiu2IUQGpCBSqqKDxWzSXHCd4Z0r1W1jQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787948793&P2=404&P3=2&P4=XdX%2fqRRDMHDoc03uYCBvVmoH3z4Tfo2oV%2fQoSiMc7P7obY6GcwUtj%2bx%2f7XDC3M4R9oC9hfm3ias2M%2fs0KqsCaA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

• C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\0a9e4338ede8500bd40fc7971bbe228b.png - bf26bcfd2270190dea274778a2d9a854c81adab23cbe8e2dd45172ccfcc9b45e
• C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 1381f8fd5c49b35758c41060a8a36cba34495dad5562bf0eb2da5f4ab5ef7e9c
• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://netcdn.online/app/431946152/what-games-on-roblox-give-you-free-robux-game-hack
• http://perpustakaan.pn-tapaktuan.go.id/repository/coin-master-card-collection-hack_GM406889139.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/best-free-minecraft-skins_GM479516143.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/100-free-spins-on-coin-master_GM406889139.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/how-to-get-tiktok-coins-for-free_GM835599320.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/get-me-free-robux_GM431946152.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/free-robux-redeem-codes_GM431946152.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/roblox-hack-generator_GM431946152.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/free-spins-for-coin-master-2021_GM406889139.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/minecraft-hacks_GM479516143.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/free-robux-for-kids_GM431946152.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/coin-master-hacks_GM406889139.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/websites-that-give-free-robux_GM431946152.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/multiplayer-master-hack-coins_GM406889139.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/free-robux-no-scam_GM431946152.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/how-long-is-the-minecraft-free-trial_GM479516143.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/coin-master-free-spin-link-today-50_GM406889139.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/mobihack-net-roblox-hack_GM431946152.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/coin-master-mod-version-free-download-v344_GM406889139.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/como-hackear-coin-master-en-espaol_GM406889139.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/i-need-robux_GM431946152.pdf
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

• netcdn.online
• perpustakaan.pn-tapaktuan.go.id

Embedded IP addresses

• 52.123.252.212
• 20.247.185.124
• 52.110.12.21
• 4.230.171.124
• 172.215.188.232
• 4.150.223.106
• 135.233.95.144
• 52.123.128.14
• 40.99.133.242
• 172.178.240.161
• 74.178.232.29
• 203.26.79.13
• 48.200.63.27
• 20.184.175.19
• 52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report