MALICIOUS — 34254048817.pdf

MALICIOUS — 34254048817.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100). 4 of 23 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: d3728bb50378492cebc1c8b5a80340d5583f6ca035b7ebf07296a7407deeca50
SHA-1: d4a65df9b5c710e0a922a310499414ea8340b876
MD5: 3698ccec334beeea69aef7a405cee9d2
ssdeep: 1536:njkTvZhTpJJAsI8BiniaAE4yKteZLmwqu5xPXDvWn3vJW3Zz1771:jIp59if4jtYLmwPbDvWn3cPN
TLSH: T14837D1F32097DC0CB7DFAF07B5F6142C649BD689306BE6549088AB1CD4E867E2E54902
Submitted as: 34254048817.pdf
File type: pdf · Size: 76402 bytes
Verdict: malicious (93/100)

Detections (4 of 23 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Kaspersky (KVRT): HEUR:Hoax.PDF.Agent.gen
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!3698CCEC334B

MITRE ATT&CK

Why this verdict

The malicious score of 93/100 is the fusion of 8 weighted signals:

Dropped a malicious payload (Lazarus): root_.cache_dconf_user - dynamic signal, weight 0.80, confidence 0.90
Contacted 36 external host(s) at runtime (3 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://ecobox.eng.br/wp-content/plugins/super-forms/uploads/php/files/ekbgnqm8oi8mu4b543446os4pj/26689904633.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://smidgel.ru/uplcv?utm_term=preposition+of+place+worksheet+for+class+2, http://unesco-mediain.cz/fckfiles/file/noxedadakivaxekiderosezaj.pdf, https://eatorhours.org/e-bussiness/fckimages/file/32536409033.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9634 behavior events · 1 ATT&CK techniques · 4 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
250.255.255.239.in-addr.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
desktop-hsgcbep
ntp.ubuntu.com
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

/opt/CAPEv2/storage/analyses/26748/files/aada6c1636c7ae28f27e302661ae393e61cb27f859fca1365a667d3e7025a8b6 - aada6c1636c7ae28f27e302661ae393e61cb27f859fca1365a667d3e7025a8b6
/opt/CAPEv2/storage/analyses/26748/files/cfd3b8bdcde49b5b4b413ff1edb1a98dd850e5b55a3362495646d071306b076d - cfd3b8bdcde49b5b4b413ff1edb1a98dd850e5b55a3362495646d071306b076d
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
tmp_tmp.oMiyV8MrXJ - 6dc963d8de6147d9e4a105e24bd0322bb194345a7e56042133873905d0119358

Embedded URLs

https://smidgel.ru/uplcv?utm_term=preposition+of+place+worksheet+for+class+2
http://unesco-mediain.cz/fckfiles/file/noxedadakivaxekiderosezaj.pdf
https://eatorhours.org/e-bussiness/fckimages/file/32536409033.pdf
https://dazzlin.co.uk/wp-content/plugins/super-forms/uploads/php/files/346b86b1fc4bbc37c5a9835751bb5442/gulop.pdf
https://ecobox.eng.br/wp-content/plugins/super-forms/uploads/php/files/ekbgnqm8oi8mu4b543446os4pj/26689904633.pdf
https://artsketch.ru/wp-content/plugins/super-forms/uploads/php/files/7c7633f45b55dcd53e8c5e29f9cfc233/didojiwoxapizuzow.pdf
https://pametnidom.hr/pametne_kuce/userfiles/file/60142153013.pdf
https://pluckywize.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608a069e967c7---58276397510.pdf
https://unique.global/wp-content/plugins/super-forms/uploads/php/files/64c9b41c76f12341a0f6d15a679cbfcd/kupiroderuxeme.pdf
http://www.expo-hotel.com/english/wp-content/plugins/formcraft/file-upload/server/content/files/1608558c5ab631---96158277388.pdf
http://www.champcaregivers.com/wp-content/plugins/formcraft/file-upload/server/content/files/160837a8d5befb---77042791205.pdf
http://www.risingstars.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/16071e5c791ab5---kowotabaramixesixaser.pdf
https://rebates.forex/wp-content/plugins/super-forms/uploads/php/files/th8apsgn84gs8n6qd4m7n6l9g4/kavebu.pdf
http://bascobrunswick.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1607d6de05f426---78781071214.pdf
http://braintradingbcn.com/wp-content/plugins/super-forms/uploads/php/files/2e9f20dfe28264d334b3edbe7eaa7f8a/jisosafexil.pdf
https://joyfool.art/wp-content/plugins/super-forms/uploads/php/files/247e60b236fab91afa256407cf27c3a9/toger.pdf
https://www.kiteschule-eckernfoerde.de/wp-content/plugins/formcraft/file-upload/server/content/files/16094181abe31a---53385954864.pdf
https://www.dishdivvy.com/wp-content/plugins/super-forms/uploads/php/files/b5e618e31684b83fe4ec6542ce28e086/verig.pdf
http://www.cuerpomenteyespiritu.es/wp-content/plugins/formcraft/file-upload/server/content/files/1606cbda80e9ae---86404662626.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

smidgel.ru
eatorhours.org
dazzlin.co.uk
ecobox.eng.br
artsketch.ru
pluckywize.com
www.expo-hotel.com
www.champcaregivers.com
bascobrunswick.com.au
braintradingbcn.com
www.kiteschule-eckernfoerde.de
www.dishdivvy.com
www.cuerpomenteyespiritu.es
www.w3.org
purl.org
ns.adobe.com
unesco-mediain.cz
pametnidom.hr
unique.global
www.risingstars.com.tr
rebates.forex
joyfool.art

Embedded IP addresses

52.123.252.235
34.160.111.145
52.123.252.202
104.21.85.170
135.233.95.144
4.150.223.99
20.247.184.197
52.110.12.42
52.110.12.55
4.230.171.124
13.69.239.69
135.232.92.34
48.211.4.16
52.123.129.14
40.103.64.242
52.148.114.188
162.159.36.2

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report