MALICIOUS — girosuvigojutajufudozi.pdf

MALICIOUS — girosuvigojutajufudozi.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 50 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: daa09ae476192a11e6f5bccf31827c3911add5649f1aac46a4371799012895d8
SHA-1: 3b26d8907ece17a06b013493acc97a52a0ad7acf
MD5: 664be244c5ec14de2e52dc1a0923d46d
ssdeep: 1536:57Jc6Mz2VUdOV71qy/Wxpp+Hw3rUWmr9uLza0YWHpOvRtyI6W14AKW+j9R:VJ2F0pjqpWW2uLG0AvRYI74AKHr
TLSH: T1E938D0F320D7DD8CB7578B533BAB016DE09AD38C3651EB5012C8BA6C953CA7D9A00592
Submitted as: girosuvigojutajufudozi.pdf
File type: pdf · Size: 83050 bytes
Verdict: malicious (96/100)

Detections (5 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Microsoft Defender: flagged
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 15 external host(s) at runtime (1 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://xsjsbzrw.com/uploads/files/93998699407.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: http://argra.rs/wp-content/plugins/formcraft/file-upload/server/content/files/1613cd40e6e2eb---bunutonexol.pdf, https://agrimal.pl/userfiles/file/gejow.pdf, http://plaschke-partner.com/uploaded/file/pafevigexumojumuginib.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9571 behavior events · 1 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
desktop-hsgcbep
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
desktop-hsgcbep._dosvc._tcp.local
desktop-hsgcbep(1)._dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

/opt/CAPEv2/storage/analyses/38609/files/67f9561c369ae19b551f1e8837ca3cb34458e6b119d6b7f3dfa56de58fab0266 - 67f9561c369ae19b551f1e8837ca3cb34458e6b119d6b7f3dfa56de58fab0266
/opt/CAPEv2/storage/analyses/38609/files/88dac04f5160793ef39103509b207262742ea2e67f2210968b41bdfd568c3aca - 88dac04f5160793ef39103509b207262742ea2e67f2210968b41bdfd568c3aca
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/skout/mBVl/~3/3CAf4wW3hvY/uplcv?utm_term=2+one+for+all+my+hero+academia
http://argra.rs/wp-content/plugins/formcraft/file-upload/server/content/files/1613cd40e6e2eb---bunutonexol.pdf
https://agrimal.pl/userfiles/file/gejow.pdf
http://plaschke-partner.com/uploaded/file/pafevigexumojumuginib.pdf
http://www.eatvirukai.lt/uploads/files/lefuladenuxirewotusirare.pdf
http://derkwoo.com/upload/editor/files/84169709186.pdf
http://prosquash.by/data/zumiwuxikewogenibive.pdf
http://xsjsbzrw.com/uploads/files/93998699407.pdf
https://bangvetthuong.com/luutru/files/xitujarevox.pdf
http://tiszaikaland.hu/upload/file/dewelifisu.pdf
http://langeline.com/ckeditor/upload/files/94704391465.pdf
http://chagatea.ru/wp-content/plugins/super-forms/uploads/php/files/c768817c1dc519e016e56dd3f7a1404f/82295196540.pdf
http://preprod.app-nomads.com/ugecam/admin/ckfinder/userfiles/files/bononodizikopexeju.pdf
http://pho32shabu.com/uploads/files/dobogotuzuwovosaloxepewo.pdf
http://logistra.fr/ressource/site-image/files/55586093690.pdf
http://vinhthuanvietnam.com/upload/files/pelufeberi.pdf
http://ky-auto.com/uploadfile/files/6584196144.pdf
http://domgr11.ru/uploads/files/mojizemav.pdf
https://miaousland.fr/ckfinder/userfiles/files/vukipagemuto.pdf
https://reviewz.eu/app/webroot/files/userfiles/files/54375780928.pdf
http://educasters.co/ckfinder/userfiles/files/13472648001.pdf
http://ctcinsulator.com/uploads/file/zemotubuxibejiwajakupa.pdf
https://megalightgroup.lv/uploads/files/73624713498.pdf
https://callmarkinvestments.com/callmark/files/mojozimokinopefare.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

feedproxy.google.com
agrimal.pl
plaschke-partner.com
derkwoo.com
xsjsbzrw.com
bangvetthuong.com
langeline.com
chagatea.ru
preprod.app-nomads.com
pho32shabu.com
logistra.fr
vinhthuanvietnam.com
ky-auto.com
domgr11.ru
miaousland.fr
reviewz.eu
educasters.co
ctcinsulator.com
callmarkinvestments.com
www.w3.org
purl.org
ns.adobe.com
argra.rs
www.eatvirukai.lt
prosquash.by

Embedded IP addresses

52.123.129.14
20.42.65.84
135.232.92.137
4.150.223.112
52.123.252.245
52.110.12.3
48.211.4.16
4.230.171.124
74.178.76.128
74.179.77.164
72.154.7.96
4.144.132.114
52.123.128.14
203.26.79.13
52.123.252.215

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report