MALICIOUS — wuxorifiwavonalixura.pdf

MALICIOUS — wuxorifiwavonalixura.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: db8cc666535f9c046c3a6a5f8f13a5e65f3594c85899efaaf27832111f360d09
SHA-1: 19a876a53eb3ec5793d0b7315507954af287ab69
MD5: c020dded52fe85fafaa7eaeb2fd32c44
ssdeep: 1536:u9wDjrbHXXiq5ZMG3re9psbZGZiQtW5JIymHyTvQpMWUpO7BhF:AwD/zniq5ZM4gpsbZe4syTvQpv7B
TLSH: T1F638DFF321DBCC9C73879B072DFE126AA04AE78455A2FA219484756C997C8FE7F00590
Submitted as: wuxorifiwavonalixura.pdf
File type: pdf · Size: 82959 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://osoboebludo.com/ckfinder/userfiles/files/nakobapojiwudezapiwono.pdf - network signal, weight 0.70, confidence 0.80
Contacted 17 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://inwebjor.ru/uplcv?utm_term=i+restart+my+phone, http://osoboebludo.com/ckfinder/userfiles/files/nakobapojiwudezapiwono.pdf, http://az-volnycas.cz/volnycas/fckphotos/file/fanegurebibavevigur.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9741 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
250.255.255.239.in-addr.arpa
desktop-hsgcbep
ntp.ubuntu.com
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 7a07653d59f688e507c59aae391b3387c58c8bbd1bedde57f3bc65b863501106
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\fca382f8729c58fbe8e2c5ff0616fc1b.png - 18f4dcdaea5a618c9ace4abbd94b131ff8f0592d8b1dd945cd05ad3afaeb9bbf
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://inwebjor.ru/uplcv?utm_term=i+restart+my+phone
http://osoboebludo.com/ckfinder/userfiles/files/nakobapojiwudezapiwono.pdf
http://az-volnycas.cz/volnycas/fckphotos/file/fanegurebibavevigur.pdf
http://lucidareemantenerepavimentifaidate.it/userfiles/files/92911098340.pdf
http://bienbao.org/uploads/files/86096434007.pdf
http://comicpapyrus.com/wp-content/plugins/super-forms/uploads/php/files/7e66c84a100aefa59f8a2d1486b52b2e/xuvubexogozutimadamilas.pdf
https://aventura-agence.lu/userfiles/files/kixubabozalan.pdf
http://xsteelstock.com/d/files/37396724156.pdf
http://wxmx.cn/upload/ckimg/files/202109121820026291.pdf
https://markzone.az/wp-content/plugins/super-forms/uploads/php/files/b1n9vq0g4066s0vt8tj93g0i7u/57319607536.pdf
http://designpavelzapletal.cz/files/file/zazixateketogujogi.pdf
https://ita.kru.ac.th/ckfinder/userfiles/files/93812234347.pdf
https://rosenstein.lu/userfiles/files/45132895095.pdf
http://pck.malopolska.pl/wp-content/plugins/super-forms/uploads/php/files/24b8e8afe3be910756658f608b98870d/jezenun.pdf
http://global-poseg.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613bd532c4714---80418190911.pdf
https://dp-silver.com/userfiles/file/wevarega.pdf
http://studiotecnicolari.it/userfiles/files/kijomevip.pdf
https://leise.ru/admin/ckfinder/userfiles/files/41964654013.pdf
http://tksvolga.ru/userfiles/file/bofijesajarizikiverubi.pdf
https://puertoestereo.com/wp-content/plugins/super-forms/uploads/php/files/f05hh58h9lcfpo7cc2mnfu6d90/40462928228.pdf
http://caacoding.net/wp-content/plugins/formcraft/file-upload/server/content/files/161417a2cedc40---zikurun.pdf
http://www.enredmail.com/templates/files/idCliente_/file/rufalejisidivudaretotus.pdf
http://lagostena.it/userfiles/files/kimororejozinurenikiponu.pdf
http://preiswerte-unterkunft-papenburg.de/mediapool/6564540973.pdf
https://inchirierielicopter.ro/wp-content/plugins/formcraft/file-upload/server/content/files/161464d2ada1a8---93835568389.pdf

Embedded domains

inwebjor.ru
osoboebludo.com
lucidareemantenerepavimentifaidate.it
bienbao.org
comicpapyrus.com
xsteelstock.com
wxmx.cn
pck.malopolska.pl
global-poseg.com
dp-silver.com
studiotecnicolari.it
leise.ru
tksvolga.ru
puertoestereo.com
caacoding.net
www.enredmail.com
lagostena.it
preiswerte-unterkunft-papenburg.de
www.w3.org
purl.org
ns.adobe.com
az-volnycas.cz
aventura-agence.lu
markzone.az
designpavelzapletal.cz

Embedded IP addresses

52.123.252.230
172.172.255.217
20.184.175.21
52.123.129.14
52.123.252.248
52.110.12.20
4.230.171.124
20.247.184.142
52.168.117.168
74.178.240.51
20.165.94.63
92.223.78.30
40.99.133.226
52.123.128.14
203.26.79.13
40.79.150.122
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report