MALICIOUS — da2c8cd2a8060279bad26c04180ffbabcb1e0d5f29b123f19fb2a806ddca1a01
MALICIOUS — da2c8cd2a8060279bad26c04180ffbabcb1e0d5f29b123f19fb2a806ddca1a01 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100). 5 of 54 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
da2c8cd2a8060279bad26c04180ffbabcb1e0d5f29b123f19fb2a806ddca1a01 - SHA-1:
ecadf7ec7f9cf60a15693d584da7f87b48c450de - MD5:
2635cc416c2b1a76c309cd1d1db538eb - ssdeep:
1536:r+u/pJ4+By8sWtZNamDJkiDgBs74WKCs7XipOVZErcBuU6H:aM/4+Q85bNhDbDV4WEM4Bul - TLSH:
T19C38DFF36197DC4C768BAB83ADA71D6C254ACB8871239A946088773DC47C3BDBE10581 - Submitted as: da2c8cd2a8060279bad26c04180ffbabcb1e0d5f29b123f19fb2a806ddca1a01
- File type: pdf · Size: 80263 bytes
- Verdict: malicious (100/100)
Detections (5 of 54 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Trellix Stinger (McAfee): PDF/Phish-FAB!2635CC416C2B
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 11 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule
Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: https://uploads.strikinglycdn.com/files/1ef43873-f52a-44aa-a1f1-dabe3ee2d463/61251369706.pdf - network signal, weight 0.70, confidence 0.80
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged PDF/Phish-FAB!2635CC416C2B (rule
PDF/Phish-FAB!2635CC416C2B) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule
HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://lozipotod.ru/strik?utm_term=english+grammar+practice+app, https://cdn-cms.f-static.net/uploads/4493200/normal_60461fbe0c50d.pdf, http://nudizelaf.rf.gd/onkyo_tx_nr809_review.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Contacted 6 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
1176 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ntp.ubuntu.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- 23.40.52.85
- 23.11.37.157
- 20.190.167.65
- 52.230.59.222 SG · Singapore · AS8075 Microsoft Corporation
- 150.171.22.17
- 23.33.238.135
- 52.110.12.56 AU · Sydney · AS8075 Microsoft Corporation
- 4.230.171.124 KR · Seoul · AS8075 Microsoft Corporation
- 23.33.238.171
- 74.178.240.51 NL · Amsterdam · AS8075 Microsoft Corporation
- 57.155.104.224 SG · Singapore · AS8075 Microsoft Limited UK
- 192.168.122.116
Dropped files
- root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://lozipotod.ru/strik?utm_term=english+grammar+practice+app
- https://cdn-cms.f-static.net/uploads/4493200/normal_60461fbe0c50d.pdf
- http://nudizelaf.rf.gd/onkyo_tx_nr809_review.pdf
- https://cdn.sqhk.co/badaxiloru/2w0DuGj/phoenix_arizona_weather_january_2019.pdf
- https://cdn.sqhk.co/xinoxoxojib/gs3oaii/tabletop_simulator_key_sale.pdf
- https://cdn-cms.f-static.net/uploads/4375528/normal_6069fc72d80bc.pdf
- https://pobapuzelikawe.weebly.com/uploads/1/3/0/7/130739661/4851436.pdf
- https://cdn.sqhk.co/futidiwe/jjc7iap/white_triple_s_sneakers.pdf
- https://uploads.strikinglycdn.com/files/1ef43873-f52a-44aa-a1f1-dabe3ee2d463/61251369706.pdf
- https://cdn-cms.f-static.net/uploads/4485570/normal_5fd3210ee3792.pdf
- https://uploads.strikinglycdn.com/files/cbd58e7b-8ca4-4f2a-bfcd-f64f16fc82bd/zigumirifefaf.pdf
- https://uploads.strikinglycdn.com/files/ee28c940-ff72-4aab-a9cd-2db3551758f5/is_cbs_going_off_the_air.pdf
- https://uploads.strikinglycdn.com/files/aaf31f15-e349-45f6-8a69-18da4206d218/dead_doctors_dont_lie_podcast.pdf
- https://uploads.strikinglycdn.com/files/04a8893d-366d-42be-bbaa-9f55337b2b8f/como_mejorar_la_educacion_a_distancia.pdf
- https://zugufirit.weebly.com/uploads/1/3/1/1/131163535/fekosi_weruvawa_xadabosuri.pdf
- http://xetutut.iblogger.org/neet_zoology_syllabus.pdf
- https://uploads.strikinglycdn.com/files/e84ca0c1-1c18-4d12-984a-8fcad748106f/puzakawazobimakogozor.pdf
- https://uploads.strikinglycdn.com/files/84974f28-d563-4c2c-a367-6b625f4a2984/47936841155.pdf
- https://uploads.strikinglycdn.com/files/e1b25e49-fd2a-4ceb-b71b-c65ecef42da9/69670541011.pdf
- https://uploads.strikinglycdn.com/files/c5e8dd9c-683a-4ee8-9e63-71f8898fc1d0/89888716429.pdf
- https://uploads.strikinglycdn.com/files/67303574-3943-4891-ba5e-c32de11479b1/crossfit_workout_routine_advanced.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- lozipotod.ru
- cdn-cms.f-static.net
- cdn.sqhk.co
- pobapuzelikawe.weebly.com
- uploads.strikinglycdn.com
- zugufirit.weebly.com
- xetutut.iblogger.org
- www.w3.org
- purl.org
- ns.adobe.com
- nudizelaf.rf.gd
Embedded IP addresses
- 52.230.59.222
- 52.110.12.56
- 4.230.171.124
- 74.178.240.51
- 57.155.104.224
- 20.42.73.26
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report