MALICIOUS — 16139a57e4a2f8---75362038378.pdf

MALICIOUS — 16139a57e4a2f8---75362038378.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: db8694a9784f35d55493eeeab8d79632c2331a8aed8343644f40f73d267e9e72
SHA-1: 50f20ce7b65a495714c196772c24fbb61e211fb5
MD5: f0c16db87a0307857b8036180b67d9ab
ssdeep: 1536:qVzq2oI8agztFFE8MgpesmqbtzxL6irOED24JjIWW2KlFw9CK5ph+SGZWbpON9Xy:Uq2oXaKtFFEUpzxL6iiEacV5ph1GbNQ
TLSH: T1ED39D0F320ABCD5D768A9B4365FB106DB08AD6CC7622FA5040887B7C947D5BDAE00532
Submitted as: 16139a57e4a2f8---75362038378.pdf
File type: pdf · Size: 90366 bytes
Verdict: malicious (95/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 95/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 17 external host(s) at runtime (2 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://krisoc.ru/uplcv?utm_term=what+is+android+11, http://www.drop-lok.com/wp-content/plugins/formcraft/file-upload/server/content/files/161375e46caa3c---59593285327.pdf, https://indoshaolinkungfusociety.com/ckfinder/userfiles/files/64806726160.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9747 behavior events · 1 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
250.255.255.239.in-addr.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\5dfd16b857c8f1e22cfbb8982571ee81.png - 8f53146d18f551a4f47487d6cb3e86aa57afccdcf0fe1da874ee3229744d39ec
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - bf3f853dde98263e43a28dc884983309a1b1b9ce525ca1da034e6461034619c7
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://krisoc.ru/uplcv?utm_term=what+is+android+11
http://www.drop-lok.com/wp-content/plugins/formcraft/file-upload/server/content/files/161375e46caa3c---59593285327.pdf
https://indoshaolinkungfusociety.com/ckfinder/userfiles/files/64806726160.pdf
http://abwingssuffolk1.com/uploads/files/norotowanina.pdf
http://vasilii-orlov.fun/wp-content/plugins/super-forms/uploads/php/files/c2473c848c4be813b593cb6990b57074/21167865605.pdf
http://qianxish.com/ckfind_image/files/60396713356.pdf
http://fcraregistration.com/UploadedData/file/75470203048.pdf
http://kimbuunguyen.com/uploads/userfiles/file/residagasukegolobute.pdf
http://roomyab.ir/basefile/roomyabir/files/72255183557.pdf
https://aryaayur.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613993b1da192---33058183624.pdf
https://www.ideaklinikbakirkoy.com/wp-content/plugins/formcraft/file-upload/server/content/files/16131733499ca2---94241809293.pdf
http://doremimarlikinsaat.com/userfiles/file/revelamagunasifetukej.pdf
http://aokunoil.com/ckfinder/userfiles/files/soxipofotazoxajonepavavok.pdf
http://chrisdepanneservices.com/Sites/cds/files/13524789148.pdf
https://afmiletisim.afmiletisimajansi.info/resimler/files/74602557036.pdf
http://venkateshservices.com/uploads/36029392789.pdf
https://andrejc.si/files/file/dojasudujibenokagekim.pdf
http://mosme.org/uploadfile/files/48154257865.pdf
https://restavracia02.com/userfiles/file/jofubowulumuwaxibi.pdf
http://mutamobilya.com/images_upload/files/dufokuvug.pdf
http://randygordonlawoffice.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/nekajewotelitilato.pdf
https://brusroom.com/wp-content/plugins/super-forms/uploads/php/files/3fb6c91a0a8243fedb03f7251ee8d6ee/29371392638.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/

Embedded domains

krisoc.ru
www.drop-lok.com
indoshaolinkungfusociety.com
abwingssuffolk1.com
vasilii-orlov.fun
qianxish.com
fcraregistration.com
kimbuunguyen.com
roomyab.ir
aryaayur.com
www.ideaklinikbakirkoy.com
doremimarlikinsaat.com
aokunoil.com
chrisdepanneservices.com
afmiletisim.afmiletisimajansi.info
venkateshservices.com
mosme.org
restavracia02.com
mutamobilya.com
randygordonlawoffice.com
brusroom.com
www.w3.org
purl.org
ns.adobe.com
andrejc.si

Embedded IP addresses

85.210.196.11
20.42.179.204
20.184.175.2
52.110.12.52
74.179.71.159
52.110.12.37
4.230.171.124
72.145.35.103
172.178.240.163
52.123.252.225
74.178.240.51
135.232.92.137
74.178.76.44
203.26.79.13
52.123.129.14
40.104.4.2
162.159.36.2

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report