MALICIOUS — dc08af26a50499ed385dd172af49a021b89f9b35325d51c952834b24820043d9

MALICIOUS — dc08af26a50499ed385dd172af49a021b89f9b35325d51c952834b24820043d9 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: dc08af26a50499ed385dd172af49a021b89f9b35325d51c952834b24820043d9
• SHA-1: 74a9ce6028a8402fe2bdad116258181b134964c9
• MD5: 7818f4e066d871297e9cb6858c67ab00
• ssdeep: 1536:E7oWWIMAt8Tblug5yIqWaAiJ5p1x2iaQ4vZN3FIMcXLTP2DwCzHZWy4h:5WWI9yXlHtqFVJ5p1YfQqZfIMcbL2sC4
• TLSH: T15C37D0F33147DD4C7ACBAB13ACD212592049C3895133DBE45888BA9CE5BC6BE6E04691
• Submitted as: dc08af26a50499ed385dd172af49a021b89f9b35325d51c952834b24820043d9
• File type: pdf · Size: 75285 bytes
• Verdict: malicious (98/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!7818F4E066D8
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1105
• T1566.002

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated malicious by URL analysis: https://ayurvedaemart.com/uploads/file/64598020074.pdf - network signal, weight 0.70, confidence 0.80
• Contacted 18 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
• Embedded network infrastructure: https://queure.ru/uplcv?utm_term=watch+gully+boy+free+online, https://ayurvedaemart.com/uploads/file/64598020074.pdf, http://www.lightingandhvacexpo.com/wp-content/plugins/super-forms/uploads/php/files/f4bf069900f2ada61973b3cfd85b7c20/metatosepamukefuve.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Extracted generic config (17 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9647 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• ntp.ubuntu.com
• 250.255.255.239.in-addr.arpa
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

• C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\1d870aeaa29d842a17d5691993dafbf2.png - 9a7409fdbaada16facb42b90c38042faf556e3bfd7f6de86c4cee5d4e74a52a5
• C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - a07b5255b50af398326c0cb4bb41b7dab720921d36fd68f24ebed2cd12ab990c
• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://queure.ru/uplcv?utm_term=watch+gully+boy+free+online
• https://ayurvedaemart.com/uploads/file/64598020074.pdf
• http://www.lightingandhvacexpo.com/wp-content/plugins/super-forms/uploads/php/files/f4bf069900f2ada61973b3cfd85b7c20/metatosepamukefuve.pdf
• http://cetinelektrik.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/160baceac6ed62---kopopaturoribuzozosafisiz.pdf
• https://www.ideaklinikkadikoy.com/wp-content/plugins/formcraft/file-upload/server/content/files/16081fae6a7658---16557985971.pdf
• https://www.audifonosdoshoydos.com/wp-content/plugins/formcraft/file-upload/server/content/files/16098a6f327a55---kexijisododivakodufenu.pdf
• http://scheiden-maassluis.nl/uploads//file/zawalogirimorupix.pdf
• https://ahi.com.ua/wp-content/plugins/super-forms/uploads/php/files/69eb102cd0f836dbafcdd553c0ae0d55/79341016455.pdf
• http://festivaldeliteraturadepereira.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a2b900ae242---3196910624.pdf
• https://amrapalispot.com/userfiles/file/sifegejimozib.pdf
• https://liniagdanskzydowo.pl/files/zovufosoketalox.pdf
• http://gingerwooddesign.com/wp-content/plugins/formcraft/file-upload/server/content/files/16080443cacb81---fevibowexexutogel.pdf
• https://sg-design.top/wp-content/plugins/super-forms/uploads/php/files/7fd7cfa2379c19b4e2837491408935f8/wotoxorazigigu.pdf
• https://unserbiokorb.ch/userfiles/file/18196749566.pdf
• https://hoffmanowska.pl/wp-content/plugins/formcraft/file-upload/server/content/files/1608e124da28c0---22791325795.pdf
• http://stopasbestos.ca/wp-content/plugins/formcraft/file-upload/server/content/files/16078b791729d4---diluzakadagoviwevaxowamut.pdf
• http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608513d7c57de---xoguxaruveresesefewokigo.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Embedded domains

• queure.ru
• ayurvedaemart.com
• www.lightingandhvacexpo.com
• www.ideaklinikkadikoy.com
• www.audifonosdoshoydos.com
• scheiden-maassluis.nl
• ahi.com.ua
• festivaldeliteraturadepereira.com
• amrapalispot.com
• liniagdanskzydowo.pl
• gingerwooddesign.com
• sg-design.top
• unserbiokorb.ch
• hoffmanowska.pl
• stopasbestos.ca
• www.1000ena.com
• www.w3.org
• purl.org
• ns.adobe.com
• cetinelektrik.com.tr

Embedded IP addresses

• 20.184.175.10
• 20.184.175.7
• 52.110.12.8
• 57.155.101.212
• 52.230.59.222
• 4.230.171.124
• 135.232.92.97
• 20.231.239.246
• 74.179.77.204
• 40.99.133.226
• 74.178.76.44
• 52.123.128.14
• 72.153.5.135
• 203.26.79.13
• 40.84.85.40
• 48.192.143.121
• 20.184.175.22
• 52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report