MALICIOUS — d69e823d34c62c47a4359a94985775fc8278a21cfc6df8ef8c0f99654c59e648

MALICIOUS — d69e823d34c62c47a4359a94985775fc8278a21cfc6df8ef8c0f99654c59e648 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: d69e823d34c62c47a4359a94985775fc8278a21cfc6df8ef8c0f99654c59e648
SHA-1: 0da6e049834f586923e8e3ac56ff449668a39337
MD5: 8adc1b2544f04d11649727f0392a8598
ssdeep: 1536:srvt12u6oqoFQnP35RfruV0D1Ay5Ghs1D2kNpdTtyksIa7Dc1eBtVR:kvt0foFw33q0D/Os1D2kNXTtyk63B1
TLSH: T15138CFF31167DD0C7A9717836DA712A9B488C3887532EB9014883B2CD57C6BE7F20851
Submitted as: d69e823d34c62c47a4359a94985775fc8278a21cfc6df8ef8c0f99654c59e648
File type: pdf · Size: 79262 bytes
Verdict: malicious (98/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!8ADC1B2544F0
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4474977/normal_5ff3f842cccf6.pdf - network signal, weight 0.70, confidence 0.80
Contacted 18 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://ponafet.ru/award?keyword=infarctus+du+myocarde+symptomes+pdf, https://cdn.sqhk.co/pixazizaze/ZTTYhcX/90990889906.pdf, https://cdn-cms.f-static.net/uploads/4369665/normal_5fe7ed6d4d4f2.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (13 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9714 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
_dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787898403&P2=404&P3=2&P4=Kr%2f0WslSpF1Fg74vtCPHT%2fdJFbv%2bNjd6FrjGk1odf1KUyv3GH%2baWDrtZln9QsdurI0bN7WGrk4dstL4IWaCjaQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\825950b01cec3acb7c2ad71ecea1b103.png - 31570165515afc4f07938e3e9f5174ffda72903b49c358ab0fc8567c52a8bf61
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 52d91566bbf753e03d72a33e706a251b193bdb3294371d8beb22c6cd5e4517a8
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://ponafet.ru/award?keyword=infarctus+du+myocarde+symptomes+pdf
https://cdn.sqhk.co/pixazizaze/ZTTYhcX/90990889906.pdf
https://cdn-cms.f-static.net/uploads/4369665/normal_5fe7ed6d4d4f2.pdf
http://vuxaputu.epizy.com/astm_a106_grb.pdf
https://cdn.sqhk.co/rowagana/wgfsZid/65704268056.pdf
https://static.s123-cdn-static.com/uploads/4474977/normal_5ff3f842cccf6.pdf
http://tesoduv.rf.gd/love_letter_malayalam_album_songs.pdf
https://s3.amazonaws.com/laginekux/28388337471.pdf
https://cdn.sqhk.co/sivumazudi/gcMojjr/fabunekejejati.pdf
https://cdn.sqhk.co/givinonu/FggAZJm/labyrinthine_fistula_vs_perilymph_fistula.pdf
http://nufudaluwunuja.22web.org/commercial_cool_-_3.2_cu._ft._mini_fridge.pdf
https://cdn-cms.f-static.net/uploads/4451348/normal_601fdf93c8581.pdf
https://s3.amazonaws.com/fowikorejodi/tubopeloragijesonowozoba.pdf
https://s3.amazonaws.com/vabemavuputenif/g._f_b._f_love_images.pdf
https://s3.amazonaws.com/nopomewegobij/traffic_racer_hack_apk_ios.pdf
https://s3.amazonaws.com/votuweroxigezog/ripamatudur.pdf
https://s3.amazonaws.com/minaxigevani/salorexevalulibinuda.pdf
https://cdn-cms.f-static.net/uploads/4469630/normal_600f013ccd64f.pdf
http://fuzaxovojige.epizy.com/digij.pdf
https://s3.amazonaws.com/mukutud/how_to_gain_3500_calories_a_day.pdf
https://static.s123-cdn-static.com/uploads/4410432/normal_5ff8541196728.pdf
http://vizezokope.iblogger.org/mufitupidubavumosubat.pdf
https://s3.amazonaws.com/rexogeguxosix/why_risk_assessment_important.pdf
https://s3.amazonaws.com/sitok/gulivojosizoxowudanek.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

ponafet.ru
cdn.sqhk.co
cdn-cms.f-static.net
vuxaputu.epizy.com
static.s123-cdn-static.com
s3.amazonaws.com
nufudaluwunuja.22web.org
fuzaxovojige.epizy.com
vizezokope.iblogger.org
www.w3.org
purl.org
ns.adobe.com
tesoduv.rf.gd

Embedded IP addresses

172.66.2.5
74.178.240.61
51.116.246.105
104.208.16.94
52.168.117.171
52.110.12.30
52.110.12.19
4.230.171.124
4.247.188.233
52.168.112.66
74.179.77.204
52.123.129.14
74.178.232.29
203.26.79.13
52.123.252.231
92.223.78.30
20.184.175.22
48.199.12.1

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report