MALICIOUS — dc36dd9be82d6bfa1d417b0ea66660c6c88388792d0493635e0b5497b10bcd64

MALICIOUS — dc36dd9be82d6bfa1d417b0ea66660c6c88388792d0493635e0b5497b10bcd64 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100). 5 of 54 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: dc36dd9be82d6bfa1d417b0ea66660c6c88388792d0493635e0b5497b10bcd64
SHA-1: 3a789380097f19fb1dd869b3e103382ad0a71cf3
MD5: 275d4da6647cbd1f5ef9ebcebf31fb79
ssdeep: 1536:hDR2PwxaRrHhrgS0zTVhUOeOD9FJyNF/8f3yWSiLK+uNqzRWspOR+x6Q5V:uVL0n3UORJyjCKZqzIRLA
TLSH: T15538D0F332A7DF4C779B9B03B9B61158A44AD788A221D7A041487BACD47C6BC7F10960
Submitted as: dc36dd9be82d6bfa1d417b0ea66660c6c88388792d0493635e0b5497b10bcd64
File type: pdf · Size: 84220 bytes
Verdict: malicious (100/100)

Detections (5 of 54 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Microsoft Defender: Trojan:PDF/Phish!atmn
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://studiocinti.eu/userfiles/files/dujomazen.pdf - network signal, weight 0.70, confidence 0.80
Microsoft Defender flagged Trojan:PDF/Phish!atmn (rule Trojan:PDF/Phish!atmn) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://catamma.ru/uplcv?utm_term=mx+player+format, http://sb-78.ru/files/file/lapepodijedozurinanimo.pdf, http://studiocinti.eu/userfiles/files/dujomazen.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Contacted 14 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 5 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in Acrobat.exe (pid 8012) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

1010 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
ntp.ubuntu.com
_dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
23.40.52.85
23.11.37.157
20.190.167.150
20.247.185.124 SG · Singapore · AS8075 Microsoft Corporation
150.171.22.17
52.110.12.49 AU · Sydney · AS8075 Microsoft Corporation
52.110.12.28 AU · Sydney · AS8075 Microsoft Corporation
4.230.171.124 KR · Seoul · AS8075 Microsoft Corporation
23.33.238.174
23.33.238.106
192.168.122.116

Dropped files

root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://catamma.ru/uplcv?utm_term=mx+player+format
http://sb-78.ru/files/file/lapepodijedozurinanimo.pdf
http://studiocinti.eu/userfiles/files/dujomazen.pdf
https://mimpiindahsatu.com/contents/files/popesebulijuruvabiwatawa.pdf
http://mirembeestate.co.ug/wp-content/plugins/formcraft/file-upload/server/content/files/16146576d39d99---xapipug.pdf
http://hysansam.com/fckeditor/userfiles/image/fogivojokuzidosovates.pdf
http://mathrainbow.com/userfiles/file/39608877158.pdf
https://tonymusic.se/UserFiles/files/948524226.pdf
http://gruppocreta.com/userfiles/files/budoj.pdf
https://rafaellopezehijo.com/upload/files/83275812926.pdf
http://jl-vacuum.com/upload/files/47549787277.pdf
https://stalbeckers.nl/userfiles/image/file/jizanisevixivodef.pdf
http://www.findvoters.com/userfiles/file/86403283640.pdf
https://oncetrabzon.com/resimler/files/57995670491.pdf
https://shipnhanh247.vn/asset/files/dukufisakelubu.pdf
http://zadonskiy.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16136cec32c36d---82731926956.pdf
http://elskup.pl/images/assets/file/wiporafagorugiroz.pdf
http://dainindo.com/Uploads/userfiles/files/46375961196.pdf
https://aksusu.com/upload/files/taxekokefigodemasef.pdf
https://chaletsuenodesol.de/files/rifebejikikepubov.pdf
https://getlovebooks.com/wp-content/plugins/super-forms/uploads/php/files/527295f313d25c702c395ad3b04d073a/lekefopidubusav.pdf
http://optimumnieruchomosci.pl/uploads/userfiles/files/84436628873.pdf
http://tofuyatogo.com/uploads/files/ginezosokufarefasogo.pdf
https://webmakler.org/userfiles/file/kimewudubopuwepivuwuli.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

catamma.ru
sb-78.ru
studiocinti.eu
mimpiindahsatu.com
hysansam.com
mathrainbow.com
tonymusic.se
gruppocreta.com
rafaellopezehijo.com
jl-vacuum.com
stalbeckers.nl
www.findvoters.com
oncetrabzon.com
zadonskiy.ru
elskup.pl
dainindo.com
aksusu.com
chaletsuenodesol.de
getlovebooks.com
optimumnieruchomosci.pl
tofuyatogo.com
webmakler.org
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

186.233.185.155
4.247.188.233
57.154.63.210
85.210.193.152
51.116.246.104
52.110.12.38
40.84.97.4
172.172.255.218
20.247.185.124
52.110.12.49
52.110.12.28
4.230.171.124
20.184.175.21
72.153.5.133

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report