MALICIOUS — d4eba78a8af2e1d5e54af43fdfba5aada590f6b588ef2f36a8d08dd726c19fc3

MALICIOUS — d4eba78a8af2e1d5e54af43fdfba5aada590f6b588ef2f36a8d08dd726c19fc3 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: d4eba78a8af2e1d5e54af43fdfba5aada590f6b588ef2f36a8d08dd726c19fc3
SHA-1: 25ce11eb6849c2bbd9eb7128a58647d9091b3798
MD5: 6a0363d15f0a46fc5886f729e3180af1
ssdeep: 1536:1zwrmaNrHMnaOEa0Ml8t295qWvlafX8hFDWspORolXLP:pwrmUsnaOEhW955AkhFiRolT
TLSH: T1AD37CFF3219BCD5C778B9F5359E71298A04ED7885036FA608088BA6CC47C97DBF105A1
Submitted as: d4eba78a8af2e1d5e54af43fdfba5aada590f6b588ef2f36a8d08dd726c19fc3
File type: pdf · Size: 71918 bytes
Verdict: malicious (99/100)

Detections (4 of 54 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 20 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://yuktiedu.com/wp-content/plugins/super-forms/uploads/php/files/a1560bb8e3226a035784e410fc4fc887/linokeresigakufurifen.pdf, http://isdoor.ru/uploads/files/9219124692.pdf, http://brandorbit.in/userfiles/file/23936438887.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

1076 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
c.pki.goog
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
23.40.52.85
23.11.37.157
162.159.142.9 US · San Francisco · AS13335 Cloudflare, Inc.

Dropped files

root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/skout/mBVl/~3/3CAf4wW3hvY/uplcv?utm_term=unless+a+man+is+born+of+water+and+spirit
https://yuktiedu.com/wp-content/plugins/super-forms/uploads/php/files/a1560bb8e3226a035784e410fc4fc887/linokeresigakufurifen.pdf
http://isdoor.ru/uploads/files/9219124692.pdf
http://brandorbit.in/userfiles/file/23936438887.pdf
http://laiksmodalux.lt/app/webroot/uploads/userfiles/files/31733621291.pdf
http://awarelaxcentrum.cz/user_files/file/posarakusezukofe.pdf
https://gizaviation.com/uploads/files/49989853143.pdf
http://cathugo-catamarans.de/res/wysiwyg/file/wobusapalexipaxokexevib.pdf
http://cafecontinentalmd.com/uploads/files/22671465025.pdf
https://willmarareachamber.com/ckfinder/userfiles/files/67547259550.pdf
https://www.okcfarmersmarket.com/wp-content/plugins/super-forms/uploads/php/files/a0c519736975ad8b9bf1ba2060fce8bc/befeka.pdf
http://rentappli.com/tinymce/jscripts/tiny_mce/plugins/phpimage/phpimage/upload/images/file/fepulijuzewutez.pdf
https://vmkstroi.ru/wp-content/plugins/super-forms/uploads/php/files/34ae26acddd4a3514d41126d07b8bef9/63276682713.pdf
https://karjerastests.bankai.lv/ckfinder/userfiles/files/motuzabebibikoliz.pdf
https://euchebnici.com/img/file/fiberegolurevoxo.pdf
https://thegioidongphuc.net/ckfinder/userfiles/files/teledugowowafaxuzu.pdf
https://njshore.drinkpoint.com/uploads/files/dusek.pdf
http://ottuk-e.org/userData/board/file/81101361159.pdf
https://www.lucaslobker.com/minor/ckfinder/userfiles/files/susiw.pdf
https://veritiesinstitute.com/wp-content/plugins/super-forms/uploads/php/files/3b96b88e1498b104a5cf21b4c65ccfe2/28962200679.pdf
http://appextskihjthj.handylover.com/upload/files/nawelujutufokogiliraxav.pdf
https://optical-axis.com/uploads/files/202109210723261704.pdf
https://skinrepublic.vn/webroot/img/files/82118259298.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/

Embedded domains

feedproxy.google.com
yuktiedu.com
isdoor.ru
brandorbit.in
gizaviation.com
cathugo-catamarans.de
cafecontinentalmd.com
willmarareachamber.com
www.okcfarmersmarket.com
rentappli.com
vmkstroi.ru
euchebnici.com
thegioidongphuc.net
njshore.drinkpoint.com
ottuk-e.org
www.lucaslobker.com
veritiesinstitute.com
appextskihjthj.handylover.com
optical-axis.com
www.w3.org
purl.org
ns.adobe.com
laiksmodalux.lt
awarelaxcentrum.cz
karjerastests.bankai.lv

Embedded IP addresses

85.210.193.152
4.247.188.233
162.159.142.9
52.123.252.240
4.230.171.124
74.179.77.204
172.64.154.167
20.165.94.54
74.178.240.61
4.144.132.223
4.150.223.108
135.232.92.137
52.230.59.222
72.154.7.112
172.172.255.218
4.150.223.105
48.211.4.16
52.123.252.195
40.84.85.40
57.155.101.212

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report