MALICIOUS — 91392359472.pdf
MALICIOUS — 91392359472.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
dee0a0100cf898647fd8ffb775437b5a6b7d30c9f4e1cc6101e3d4ea4ffa7b18 - SHA-1:
742d8928908379f331f961cf32d187f0300c8af0 - MD5:
160f9067d2af07883d7396296bd253d5 - ssdeep:
1536:/uV9yADa2bQG4pEhqKr7dIElb3B1t9eebti4mBJdJnWmG/V/J4WQpOCTR3bESVP8:mV9z3drwaplb3Bth84mBJfeFJnCRYSa - TLSH:
T15739C0F322EBDD5C764B9B47B6FA1168644DE78860739A90448CB76CC8BC6BD7E00510 - Submitted as: 91392359472.pdf
- File type: pdf · Size: 91506 bytes
- Verdict: malicious (98/100)
Detections (4 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 7 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: https://luxartparquet.com/wp-content/plugins/super-forms/uploads/php/files/f5c1735d3642466e9538286c85da8d71/88421487242.pdf - network signal, weight 0.70, confidence 0.80
- Contacted 16 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: http://pallenberg-busreisen.de/uploads/files/98622502091.pdf, https://monacollection.ua/wp-content/plugins/super-forms/uploads/php/files/d029acbb24793b9a42a120cd1920ebbd/juwarelikotozomo.pdf, https://luxartparquet.com/wp-content/plugins/super-forms/uploads/php/files/f5c1735d3642466e9538286c85da8d71/88421487242.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
9764 behavior events · 0 ATT&CK techniques · 3 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ntp.ubuntu.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787778469&P2=404&P3=2&P4=LQiMXwy9GfK%2fWa7d9GPyUiXfCIGXbMxVy0nqDlwCqIepaMgPdia39pSkiQQJNkj973GKpktZ0SgcMW%2fwxMR6EA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787778496&P2=404&P3=2&P4=Guip3Afu5HxMSObcsGghCfx%2f4Yl%2fhoh83t41gmHAwcnGuR9zIN6fE3tPNZRggFGMDwgfriqdvDFa2p%2fs5ZHwmA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787175230&P2=404&P3=2&P4=G46Oido48ciCYsjV5uBBOnou3hD3LfMpawvgeslHta%2b9HRf0G1ptyawUeZQKd4OkwauWYvMmUP%2fscqHyY6U%2f2g%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
Dropped files
- C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt -
2e089833ac1ffbae95489a3c56cf9349c05441a13e8240069ca87b6a14aa1797 - C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\adba9126821524afd58a1d15b6d20de0.png -
88a8a3c4dc10d4b72571fb2d54e5e586f3d2b5077c33a0122e33d9243d77386f - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://feedproxy.google.com/~r/skout/mBVl/~3/3CAf4wW3hvY/uplcv?utm_term=network+security+essentials+application+and+standards+written+by+william+stallings
- http://pallenberg-busreisen.de/uploads/files/98622502091.pdf
- https://monacollection.ua/wp-content/plugins/super-forms/uploads/php/files/d029acbb24793b9a42a120cd1920ebbd/juwarelikotozomo.pdf
- https://luxartparquet.com/wp-content/plugins/super-forms/uploads/php/files/f5c1735d3642466e9538286c85da8d71/88421487242.pdf
- https://viveironativodevicosa.com.br/ckfinder/userfiles/files/99294005873.pdf
- https://tirthmobile.com/wp-content/plugins/super-forms/uploads/php/files/7k8h6cgdpv7hdgf504mlufe4cj/vojakerodagogawazaseg.pdf
- http://ateliergermain.net/sites/default/files/file/31153038114.pdf
- https://natyabio.com/uploadfiles/94949975838.pdf
- https://arerp.kr/data/file///39491001308.pdf
- https://aymfly.com/aym_image/files/raxusubul.pdf
- https://nistd.in/userfiles/file/sebapokadapatobiriruxu.pdf
- http://www.sarajevo-inn-grunewald.com/wp-content/plugins/formcraft/file-upload/server/content/files/16086215b2882b---40754747989.pdf
- http://julieesteban.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ec3fd6be8e8---41918285393.pdf
- https://digireg.dk/upload/mozoke.pdf
- https://www.cdscabling.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160b1fc42b712c---tijurupekopebarogonotibal.pdf
- https://asiaviews.org/wp-content/plugins/super-forms/uploads/php/files/v8attjsih1vd45njofv3hnplh5/74100041305.pdf
- http://starwindows.ie/ckfinder/userfiles/files/vikinabozivo.pdf
- http://www.grundys.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1607e4172603fc---8031778593.pdf
- http://www.mmalappeenranta.com/tiedostot/files/faliloderevilurobifon.pdf
- http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608f9e560f638---birigukogatogilavabu.pdf
- https://bravo-hk.com/userfiles/file/94451772138.pdf
- http://chromoink.com/updates/file/22511021661.pdf
- http://smartcookieacademy.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a5a97e02ac0---87293534891.pdf
- http://ophtalmic-overnight.fr/wp-content/plugins/formcraft/file-upload/server/content/files/1606f4613ccbfc---4375775885.pdf
- https://hafa-verein.de/wp-content/plugins/super-forms/uploads/php/files/df482dbe020c969a664b3129570d796a/wipusurubidufowar.pdf
Embedded domains
- feedproxy.google.com
- pallenberg-busreisen.de
- monacollection.ua
- luxartparquet.com
- viveironativodevicosa.com.br
- tirthmobile.com
- ateliergermain.net
- natyabio.com
- arerp.kr
- aymfly.com
- nistd.in
- www.sarajevo-inn-grunewald.com
- julieesteban.com
- www.cdscabling.co.uk
- asiaviews.org
- www.grundys.com.au
- www.mmalappeenranta.com
- www.1000ena.com
- bravo-hk.com
- chromoink.com
- smartcookieacademy.com
- ophtalmic-overnight.fr
- hafa-verein.de
- www.w3.org
- purl.org
Embedded IP addresses
- 4.150.223.101
- 52.110.12.24
- 4.230.171.124
- 20.42.179.204
- 52.230.60.54
- 74.179.71.159
- 72.153.5.139
- 203.26.79.13
- 4.150.223.107
- 135.233.95.144
- 104.208.16.94
- 52.123.129.14
- 74.178.76.128
- 52.123.252.215
- 4.150.223.103
- 48.199.12.1
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report