MALICIOUS — ddae4ebd3b4b952d686c54adb6bbeb071516f9f29596b40b92311aa6a3868a63

MALICIOUS — ddae4ebd3b4b952d686c54adb6bbeb071516f9f29596b40b92311aa6a3868a63 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: ddae4ebd3b4b952d686c54adb6bbeb071516f9f29596b40b92311aa6a3868a63
SHA-1: e96397c55b966df570c0a4434b7755956b67e4ec
MD5: d8929cc43fd038bad0a0327566737c3e
ssdeep: 1536:Hx9KRiWn7MlR5dA1WRHvB1DRWB/JQBXpLWapOtQk5LQe55:R9w7m5AERHDDe/JuXpEtQYUw
TLSH: T13337CFF32197EC8CB75F5B037DAB119C54C6DB886272E7604084B56C92BC67EAF04981
Submitted as: ddae4ebd3b4b952d686c54adb6bbeb071516f9f29596b40b92311aa6a3868a63
File type: pdf · Size: 70444 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Contacted 25 external host(s) and 8 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://iohrp.org/f_files/files/bofikevidebusazibep.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://krisoc.ru/uplcv?utm_term=how+many+digits+are+there+in+50+000, https://iohrp.org/f_files/files/bofikevidebusazibep.pdf, https://indiantalentjunction.com/milan/media/40995872666.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9590 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
_dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - f862d05aa6afb7b6e7d6b011a5e904df72e39e2df77d0dd711a228cef69456b4
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\42673edc5367477dc0b1163ce2000a31.png - 4616c225cfd87691d3636575a53941c12098fbf1395ea3ef8194c363904f5485
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://krisoc.ru/uplcv?utm_term=how+many+digits+are+there+in+50+000
https://iohrp.org/f_files/files/bofikevidebusazibep.pdf
https://indiantalentjunction.com/milan/media/40995872666.pdf
http://freewest.at/lupakozofakuwidina.pdf
http://mvsexpo.ru/admin/ckfinder/userfiles/files/mebosanovunagotola.pdf
http://sghr.ca/upload/ckfinder/files/90479778985.pdf
https://gmonlinestore.com/wp-content/plugins/formcraft/file-upload/server/content/files/1615c6527a4673---peboxifirokopix.pdf
http://alacartedesign.de/userfiles/file/13803016767.pdf
http://www.nisbd.com/wp-content/plugins/formcraft/file-upload/server/content/files/16151c6ba6c6be---deriwotanurofosegimolixul.pdf
https://www.aaptuk.org/ckfinder/userfiles/files/53572608168.pdf
http://soft-pro.hr/upload/datoteke/disifojaxini.pdf
https://hanyauntuktesting.com/contents/files/wugaxefiwivubekagi.pdf
https://rt9.rspo.org/ckfinder/userfiles/files/15012523533.pdf
http://www.fishandcosolicitors.com/uploads/files/wurutuxemezeros.pdf
http://vetcasatenovo.it/userfiles/files/69971009148.pdf
http://obchodsezlatem.cz/upload/files/verowuxigobipojinapez.pdf
http://www.myhhsi.com/wp-content/plugins/super-forms/uploads/php/files/4ec46ba801ebe5f38b67a49d6d8ec443/naxisaledawepuru.pdf
https://rainbowfurnitures.com/files/files/78217421257.pdf
https://www.grandiosa.is/wp-content/plugins/super-forms/uploads/php/files/3so6bdeeeu0veehsfs4jbsdm23/84843860480.pdf
http://buydecor.ru/uploads/files/35655495680.pdf
https://vsevolozhsk.mebel18.com/uploads/files/51106756359.pdf
http://agro-pasz.pl/ckfinder/userfiles/files/biteselofibizawuralekatig.pdf
https://t2sc.me/userfiles/28121915285.pdf
https://rodolphe-blanchet.fr/Rodolphe/fckeditor/file/75171207347.pdf
https://greenlakepaint.com/ckfinder/userfiles/files/80241239602.pdf

Embedded domains

krisoc.ru
iohrp.org
indiantalentjunction.com
mvsexpo.ru
sghr.ca
gmonlinestore.com
alacartedesign.de
www.nisbd.com
www.aaptuk.org
hanyauntuktesting.com
rt9.rspo.org
www.fishandcosolicitors.com
vetcasatenovo.it
www.myhhsi.com
rainbowfurnitures.com
buydecor.ru
vsevolozhsk.mebel18.com
agro-pasz.pl
t2sc.me
rodolphe-blanchet.fr
greenlakepaint.com
driver-jazda.pl
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

4.150.223.113
51.105.71.136
4.207.44.65
52.123.252.212
52.123.252.240
40.84.97.4
52.110.12.32
4.144.132.114
4.230.171.124
72.154.7.101
172.215.188.232
203.26.79.13
52.123.252.239
52.123.252.234
74.178.240.61
4.150.223.100
20.76.201.171
74.179.77.204
52.123.128.14
135.233.45.221
92.223.78.30
135.233.45.222
48.199.12.1
52.168.117.168
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report