MALICIOUS — d36f87bbb08ab83612a247f3ae05f50cde9ae8d90177151349f0e34e09e294f3

MALICIOUS — d36f87bbb08ab83612a247f3ae05f50cde9ae8d90177151349f0e34e09e294f3 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: d36f87bbb08ab83612a247f3ae05f50cde9ae8d90177151349f0e34e09e294f3
SHA-1: 7046c88bc389addae190493616fa7a9a1899e922
MD5: 49cb7a8d771377eb745ccad70094455b
ssdeep: 1536:tKS5/GNcMpp7wIvXw44TnrMkvCjHEHQENzYuFVnWaaSyuhPYWUpO73kI:ES5+5ppVXw4uQzkHQacuFElqP77v
TLSH: T11438C0F321D7DC8C76879B439DEA2268B085D6C86177EB541484B7AC88F85BC7F148A0
Submitted as: d36f87bbb08ab83612a247f3ae05f50cde9ae8d90177151349f0e34e09e294f3
File type: pdf · Size: 81864 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 20 external host(s) and 8 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://npcbalkan.net/ckeditor/ckfinder/userfiles/files/1451016109.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://rimsball.com/ckfinder/userfiles/files/55460757885.pdf, http://npcbalkan.net/ckeditor/ckfinder/userfiles/files/1451016109.pdf, http://tbm-mova.by/images_from_html_editor/file/fikuwupakefa.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9743 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787949065&P2=404&P3=2&P4=mTswcjpJU%2f80LUuu14rt9SGROPMkzFmVjDLStduXR6%2fxr2cjLpHTdGYFkAYSQCulgIu39VScYhtDxAW%2fVqyWOw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\b3efdff347057cff173d7ef7d81e4b28.png - 040af4f549022812dd877f92383f7e5531e231352e18d33e1e77f1e39eed564a
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - a7844294e628e462420c37b7897420149c4afb56cbd64047e1c903faefcf85d9
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

http://feedproxy.google.com/~r/Xvkpad/~3/4dZi1sgP-vI/uplcv?utm_term=best+themes+for+powerpoint
https://rimsball.com/ckfinder/userfiles/files/55460757885.pdf
http://npcbalkan.net/ckeditor/ckfinder/userfiles/files/1451016109.pdf
http://tbm-mova.by/images_from_html_editor/file/fikuwupakefa.pdf
http://edwindijk.nl/home/edijk/domains/edwindijk.nl/public_html/uploads/file/93417566242.pdf
http://yakutiaprime.ru/SITE/files/editor/file/tozukovadowiz.pdf
https://et-auditing.com/userfiles/files/91527996863.pdf
http://awarelaxcentrum.cz/user_files/file/xazokosibuwiwusu.pdf
http://sor1310.com/userfiles/file/1510134853.pdf
http://paymentsbusiness.ca/wp-content/plugins/formcraft/file-upload/server/content/files/161432198554ea---jugekizazaxawaxak.pdf
http://www.sname.org.tw/sname/ckfinder/userfiles/files/nagukemigubedi.pdf
http://wxmx.cn/upload/ckimg/files/202110040647118467.pdf
http://aquamedia.cn/ckfinder/userfiles/files/tinowopusisolufuf.pdf
https://7foro.exceltur.org/exceltur_nuevo/ckfinder/userfiles/files/pozubolukibifafojoxosiluv.pdf
http://demenagements-remond.fr/userfiles/file/20210901070137.pdf
https://appchecar.com/ckfinder/userfiles/files/totoliwunetezavafem.pdf
https://pnvvr.ro/userfiles/file/51140974385.pdf
http://turningpointdigital.com/cote_dor_import/admin/ckfinder/userfiles/files/vedamematulitaj.pdf
http://bascobrunswick.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/16132c50fa5c00---68593965885.pdf
http://status-go.net/gfx/userfiles/files/54426560904.pdf
http://www.thelawchamber.com/wp-content/plugins/formcraft/file-upload/server/content/files/16164660fb955e---kuwapavigumu.pdf
http://tillyardci.com/userfiles/file/lanevekat.pdf
http://altiro.nl/home/tjerk/file/gerodopumanijijapekedesa.pdf
https://linhngapt.vn/upload/files/67390406436.pdf
http://emannsltd.com/userfiles/78819473795.pdf

Embedded domains

feedproxy.google.com
rimsball.com
npcbalkan.net
edwindijk.nl
yakutiaprime.ru
et-auditing.com
sor1310.com
paymentsbusiness.ca
www.sname.org.tw
wxmx.cn
aquamedia.cn
7foro.exceltur.org
demenagements-remond.fr
appchecar.com
turningpointdigital.com
bascobrunswick.com.au
status-go.net
www.thelawchamber.com
tillyardci.com
altiro.nl
emannsltd.com
www.w3.org
purl.org
ns.adobe.com
tbm-mova.by

Embedded IP addresses

172.215.188.232
15.197.225.128
172.66.2.5
51.116.253.169
184.84.165.136
52.110.12.4
52.110.12.18
4.230.171.124
52.230.60.54
135.232.92.137
20.165.94.54
20.76.201.171
74.178.76.128
52.123.128.14
74.179.71.159
72.145.35.106
203.26.79.13
52.123.252.213
4.209.250.170
20.42.65.94

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report