MALICIOUS — d75b2052e44ebb906c775a338a6eeb31499215d24eb4b1b09efd0d5a3cf91c5d

MALICIOUS — d75b2052e44ebb906c775a338a6eeb31499215d24eb4b1b09efd0d5a3cf91c5d is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: d75b2052e44ebb906c775a338a6eeb31499215d24eb4b1b09efd0d5a3cf91c5d
SHA-1: f5c1639eb8b8118ee6971c5d234c5f8ab8eb00ab
MD5: cf92a4290cc7d89ac34e8bd59c30c8e3
ssdeep: 1536:oMzYOI4/Ysu4Om6+WPNxJL3pyHaLPlaLfL0O5LuqWapOtQHWHrn7ymAqNP9cfK:sKYx4OhPJL37LPla7QcuXtQsT7hplr
TLSH: T1CF39D0F36097DD1CB3969F43AD662168A08AD788A3B1DA60448C7F6CC4BC57C7F04112
Submitted as: d75b2052e44ebb906c775a338a6eeb31499215d24eb4b1b09efd0d5a3cf91c5d
File type: pdf · Size: 85477 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://whitedwarf.ru/public/images/ckfinder/files/36723239486.pdf - network signal, weight 0.70, confidence 0.80
Contacted 19 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://jandenzobv.com/image_uploads/file/58511648324.pdf, http://whitedwarf.ru/public/images/ckfinder/files/36723239486.pdf, http://www.commandinglife.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d12d95d92c---64017876632.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9690 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 21fe9bfa7f47a6b65c5910b93bb07bed32e66ae5370658b1ffd172cbc296a2c6
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\2d7e99a07c01b40ba502c2b3fb2aee47.png - 28761cda0f4a88358372f3e7796e7340a1e0170bee313f98b224070ae3f285ee
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/BkSY9tpko7c/uplcv?utm_term=card+number+and+security+code+generator
http://jandenzobv.com/image_uploads/file/58511648324.pdf
http://whitedwarf.ru/public/images/ckfinder/files/36723239486.pdf
http://www.commandinglife.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d12d95d92c---64017876632.pdf
http://elard-group.com/ckfinder/userfiles/files/lujupibikodufid.pdf
http://ajarnveerapong.com/UserFiles/file/masetow.pdf
https://ecoretras.com/file/gasivubekenuve.pdf
https://whitelightdesign.com/wp-content/plugins/super-forms/uploads/php/files/3e949f8df6e19aeca067ea674ae521f3/vujulakobivi.pdf
http://indiebookoftheday.com/wp-content/plugins/formcraft/file-upload/server/content/files/160afd8d64efb4---14727285236.pdf
http://mwcapital.net/ckfinder/userfiles/files/20342160052.pdf
https://giltmorestukko.hu/ckfinder/userfiles/files/jeduvavozenufumodomijem.pdf
https://www.luxboss.com/ckfinder/userfiles/files/12923313391.pdf
http://www.fattyweng.com.sg/wp-content/plugins/formcraft/file-upload/server/content/files/16070650de8638---44831450250.pdf
http://csc0451.com/userfiles/file/20210724111830_v61g5i.pdf
https://ecef-groupe.com/wp-content/plugins/super-forms/uploads/php/files/du59emmgehnuf29f2guog38p64/74703824530.pdf
https://tecsal.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160a29282083e2---37320591572.pdf
https://eternalbliss.net/file/97192193061.pdf
https://www.c2commercial.com/wp-content/plugins/super-forms/uploads/php/files/7eab946c1be26e85b06e24ea79a86b22/1188423206.pdf
http://skogsformedling.se/bilder_umeny/File/towar.pdf
http://alcantara.cz/data/file/29201016255.pdf
http://vincityhomes.vn/wp-content/plugins/super-forms/uploads/php/files/lpqmvhh4236jmi0q6u38hjhbhr/68899542088.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/

Embedded domains

feedproxy.google.com
jandenzobv.com
whitedwarf.ru
www.commandinglife.com
elard-group.com
ajarnveerapong.com
ecoretras.com
whitelightdesign.com
indiebookoftheday.com
mwcapital.net
www.luxboss.com
www.fattyweng.com.sg
csc0451.com
ecef-groupe.com
tecsal.com.br
eternalbliss.net
www.c2commercial.com
skogsformedling.se
www.w3.org
purl.org
ns.adobe.com
giltmorestukko.hu
alcantara.cz
vincityhomes.vn

Embedded IP addresses

172.172.255.216
52.110.12.44
172.215.188.225
52.110.12.5
20.165.94.54
4.230.171.124
20.236.44.162
20.165.94.63
4.144.132.114
104.208.16.94
203.26.79.13
52.123.252.193
135.233.45.221
52.123.252.241
4.150.223.104
135.233.95.144
4.207.44.65
48.199.12.1
51.116.253.170

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report