MALICIOUS — df1b431d0feb517743d286aeb7b42776f4ca62d6bd7cc468d69a345964a62505

MALICIOUS — df1b431d0feb517743d286aeb7b42776f4ca62d6bd7cc468d69a345964a62505 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: df1b431d0feb517743d286aeb7b42776f4ca62d6bd7cc468d69a345964a62505
SHA-1: da1e36eccee6aa663aa83d65a423b8972df2e6e6
MD5: d91d1bac1d2ba13c2956501e3551d043
ssdeep: 1536:wXLfYBztqX1pSdSWErlQo8WGpOKK5PBqHTsWiRwD6kBX/9:wewImrlQMKyPWTugBF
TLSH: T15937CFF32093DC8C7A865F036DAE129DA18AD7CD2176DBA0008CA56CD57C6ADBA04F51
Submitted as: df1b431d0feb517743d286aeb7b42776f4ca62d6bd7cc468d69a345964a62505
File type: pdf · Size: 71279 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://youzedu.com/ckimages/files/20210904005044383666.pdf - network signal, weight 0.70, confidence 0.80
Contacted 23 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://semineebrasov.ro/printuri-fi/files/dazawesizuti.pdf, http://faw-asia.com/image/upload/files/95447480311.pdf, http://hiredriver.com/uploads/assets/files/letiti.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9609 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
desktop-hsgcbep
250.255.255.239.in-addr.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - f9243265683914c2ca467efc7af731412b12a53d436f573f1ff5a74a7cfd3317
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\45824114bb3352c09fabb4ccd4e1dc4e.png - 3b6c1b41b1d50429a5f9dd7b40225574699853b1cee6e0653fed6b511e67f239
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/ngfLrbzwjls/uplcv?utm_term=how+to+download+photos+from+icloud+to+android
https://semineebrasov.ro/printuri-fi/files/dazawesizuti.pdf
http://faw-asia.com/image/upload/files/95447480311.pdf
http://hiredriver.com/uploads/assets/files/letiti.pdf
http://tbeaindia.com/userfiles/file/xuriwidu.pdf
https://livredart.com/ckfinder/userfiles/files/suwelorovebimomijutepop.pdf
http://pokewaveanaheim.com/uploads/files/67675612244.pdf
https://ssekolkata.com/ckfinder/userfiles/files/saxaxotaworusexefaru.pdf
http://auxerretv.com/content/public/file/83613300192.pdf
http://youzedu.com/ckimages/files/20210904005044383666.pdf
http://www.hkwebdesign.com.hk/wp-content/plugins/formcraft/file-upload/server/content/files/16136166d3dba1---jabezotasuwoxag.pdf
https://unitedfightalliance.com/ckfinder/userfiles/files/daviratokijizu.pdf
https://egf.tw/test2/images/file/vefetujagawivi.pdf
http://kuehllawpc.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/xobosabivi.pdf
http://dspec-car.com/js/upload/files/lezametifumadilerekomuf.pdf
http://getsolarnj.com/userfiles/file/puxanepopabunowerejutiju.pdf
http://yourhandmadeitems.com/userfiles/file/91519783016.pdf
http://www.wm-meyer.de/meyer/admin/editor/ckfinder/userfiles/files/gomadirulizinuzolo.pdf
http://marketingnews.fr/images/file/tudalufazudekerexuruxeb.pdf
http://www.fullertherapy.com/wp-content/plugins/formcraft/file-upload/server/content/files/16132d04b6cecc---76825180869.pdf
http://interroadholland.nl/userfiles/file/38871453722.pdf
http://saigonford3s.com/uploads/2021-09-09/images/files/gamiviteretunagu.pdf
https://mehfermobilsaglik.com/userfiles/file/55448261667.pdf
http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/161413140930f8---gefozorutesun.pdf
http://carrozzeriardue.it/userfiles/files/18573240365.pdf

Embedded domains

feedproxy.google.com
faw-asia.com
hiredriver.com
tbeaindia.com
livredart.com
pokewaveanaheim.com
ssekolkata.com
auxerretv.com
youzedu.com
www.hkwebdesign.com.hk
unitedfightalliance.com
egf.tw
kuehllawpc.com
dspec-car.com
getsolarnj.com
yourhandmadeitems.com
www.wm-meyer.de
marketingnews.fr
www.fullertherapy.com
interroadholland.nl
saigonford3s.com
mehfermobilsaglik.com
www.1000ena.com
carrozzeriardue.it
myxroad.net

Embedded IP addresses

20.42.65.94
135.232.92.137
52.123.128.14
20.42.179.192
52.168.117.169
48.211.4.16
20.42.73.31
125.56.205.32
52.110.12.38
52.110.12.16
57.155.101.212
4.230.171.124
4.144.132.114
20.184.175.17
20.231.239.246
74.178.240.61
52.123.129.14
172.178.240.162
135.233.95.80
203.26.79.13
4.150.223.109
4.150.223.115
48.192.143.121

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report