MALICIOUS — d2618b120352ae2cfa7d546e0b1b7b0327e3f7d74e3f19fd95fa271057081af7

MALICIOUS — d2618b120352ae2cfa7d546e0b1b7b0327e3f7d74e3f19fd95fa271057081af7 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: d2618b120352ae2cfa7d546e0b1b7b0327e3f7d74e3f19fd95fa271057081af7
SHA-1: 901affa97dc93a2291868d97ef915456dbb2d8a3
MD5: 2f1479d599abee8cf912047f3313703d
ssdeep: 1536:JUvyJhSlyJNc5KAnuhXwLPefFA+xR7ydXpWcoRv0XC/ZW8pO7zY5O3XP+:HhSlyJKHnuhXoPMAyhqXdoRv0XC/w7DW
TLSH: T16437C0F331DBEC4C765B9F0369AF129D9086E74821B2DAA080C8766CD5BC5BD7E14901
Submitted as: d2618b120352ae2cfa7d546e0b1b7b0327e3f7d74e3f19fd95fa271057081af7
File type: pdf · Size: 70163 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://stdtekstil.com/upload/ckfinder/files/93001095747.pdf - network signal, weight 0.70, confidence 0.80
Contacted 27 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://coluer.ir/documents/file/dolikatagujalipofusoj.pdf, http://abwninemile.com/uploads/files/gemula.pdf, http://crystaltrade.hu/data/file/gizumobo.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9674 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
_dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 8fd8b61253e07915e137c4ad5ae86637f155b2f298670e74513873f652fd1695
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\d63c407e1636c48c457f38cc124d2c92.png - e8a40ea89470be1a06e04a7b7b92b8ac06f2ef3487a08798aece049689558d5c
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/S30rS-6n6vg/uplcv?utm_term=todo+android+apps
https://coluer.ir/documents/file/dolikatagujalipofusoj.pdf
http://abwninemile.com/uploads/files/gemula.pdf
http://crystaltrade.hu/data/file/gizumobo.pdf
https://armour-technoz-ca.otzol.net/ckfinder/userfiles/files/54550821722.pdf
http://plenaseguroseprevidencia.com/fotosempresa/files/padim.pdf
https://stdtekstil.com/upload/ckfinder/files/93001095747.pdf
http://veterinariomauracotti.it/userfiles/files/83307770157.pdf
https://nexapos.com/upload/files/9969706035.pdf
http://www.village-gaulois.org/gestion/ckfinder/userfiles/files/tigitofabavowiteritub.pdf
https://its-bulgaria.bg/files/file/70449772949.pdf
https://calendarsunrooms.com/userfiles/files/95138492004.pdf
http://www.dnevi-sekretarjev.eu/wp-content/plugins/formcraft/file-upload/server/content/files/1613fe58f286df---84784155255.pdf
https://songhong.info/userfiles/file/29339235913.pdf
https://caribemed.com/userfiles/file/dazafebadobapekazif.pdf
https://hbphoto.ca/resimler/files/funomizaranaroguxuraw.pdf
http://iraneto.com/basefile/iranetocom/files/25488391310.pdf
http://space-edge.com/upload/files/xotibikopiratawudorome.pdf
http://ahchala.com/img/file/52294340207.pdf
http://pass38.com/images/contentimages/files/90527005237.pdf
https://www.hmgfinance.com/ckfinder/userfiles/files/fifevaxemi.pdf
http://seychelles-resort.com/images/blog/file/jalogemuvefot.pdf
http://montpellier-business-plan.fr/mbp/upload/images/images/upload/ckfinder/14728102899.pdf
https://trade.inter-ural.ru/ckfinder/userfiles/files/vibotarenapar.pdf
http://xinge168.com/uploads/files/20210925235333_400929.pdf

Embedded domains

feedproxy.google.com
coluer.ir
abwninemile.com
armour-technoz-ca.otzol.net
plenaseguroseprevidencia.com
stdtekstil.com
veterinariomauracotti.it
nexapos.com
www.village-gaulois.org
calendarsunrooms.com
www.dnevi-sekretarjev.eu
songhong.info
caribemed.com
hbphoto.ca
iraneto.com
space-edge.com
ahchala.com
pass38.com
www.hmgfinance.com
seychelles-resort.com
montpellier-business-plan.fr
trade.inter-ural.ru
xinge168.com
himalayakebab.com
www.w3.org

Embedded IP addresses

4.247.188.224
57.154.63.210
20.184.175.6
162.159.142.9
52.123.252.227
4.144.132.114
52.110.12.14
52.110.12.53
4.230.171.124
20.42.179.192
135.232.92.137
20.184.175.8
20.76.201.171
52.123.252.204
52.123.129.14
203.26.79.13
52.123.252.246
52.123.252.215
92.223.78.30
135.232.92.34
20.42.179.204
135.234.160.244
4.209.250.170
20.42.73.31
4.150.223.111

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report