MALICIOUS — e1be65668034f7539c80a2fed94062e32e6b47e0f9e993fb4a946aab265b8a6d
MALICIOUS — e1be65668034f7539c80a2fed94062e32e6b47e0f9e993fb4a946aab265b8a6d is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100). 3 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
e1be65668034f7539c80a2fed94062e32e6b47e0f9e993fb4a946aab265b8a6d - SHA-1:
df92e726573ca09e33909237cf4894bcd892050c - MD5:
30964e4a01a9f5d490ba44aa474bd711 - ssdeep:
1536:G2GRqSeRUE0gK2KTKIOXmVIUEKTW6pOu26W7NR3+a2VvU:XGRS+BV2IOXmWhu2fR3+BxU - TLSH:
T1CE36BFF32087DD9CB7CF1787B9A71198A0CDF3489112E654918CA668E1FC9BDBD04A42 - Submitted as: e1be65668034f7539c80a2fed94062e32e6b47e0f9e993fb4a946aab265b8a6d
- File type: pdf · Size: 65255 bytes
- Verdict: malicious (97/100)
Detections (3 of 54 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 97/100 is the fusion of 8 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule
HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://praktijk.zorglink.nl/ckfinder/userfiles/files/dagubo.pdf, http://gillsandgeckos.com/userfiles/file/rimesa.pdf, https://ckv-siemreap.org/ckfinder/userfiles/files/89844839447.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Contacted 16 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
991 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- desktop-hsgcbep._dosvc._tcp.local
- desktop-hsgcbep(1)._dosvc._tcp.local
- desktop-hsgcbep(2)._dosvc._tcp.local
- desktop-hsgcbep(3)._dosvc._tcp.local
- desktop-hsgcbep(4)._dosvc._tcp.local
- ntp.ubuntu.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- 23.40.52.209
- 23.11.37.157
- 20.190.167.65
- 52.123.252.242 AU · Sydney · AS8075 Microsoft Corporation
- 52.110.12.40 AU · Sydney · AS8075 Microsoft Corporation
- 52.110.12.3 AU · Sydney · AS8075 Microsoft Corporation
- 23.33.238.102
Dropped files
- root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/zMnd8XtcwSM/uplcv?utm_term=wifi+hack+for+android+10
- https://praktijk.zorglink.nl/ckfinder/userfiles/files/dagubo.pdf
- http://gillsandgeckos.com/userfiles/file/rimesa.pdf
- https://ckv-siemreap.org/ckfinder/userfiles/files/89844839447.pdf
- http://andreevmag.com/wp-content/plugins/super-forms/uploads/php/files/4e3d21b96dbb5286f60e4ea879b0f56a/vugepebojal.pdf
- https://unitedfightalliance.jordanadams.com/ckfinder/userfiles/files/50536991946.pdf
- http://gingerwooddesign.com/wp-content/plugins/formcraft/file-upload/server/content/files/16130300e4ed2e---63017981714.pdf
- https://mymovingestimate.com/wp-content/plugins/super-forms/uploads/php/files/ee10edea5ae42a0008fd6c0281ee0356/95592157077.pdf
- https://imapcb.org/wp-content/plugins/super-forms/uploads/php/files/776f3e993ee1689fd453231773cd6681/javapupesezujazosonekesu.pdf
- https://marblobaths.ph/app/webroot/img/files/sepodotulokuko.pdf
- http://ikra-ekb.ru/files/fckeditor/file/borevawosoxo.pdf
- https://sadhankendra.org/erc/media/vowikazajuboxivuputedemo.pdf
- http://cwesp.biz/upload/file/wulokubazozinu.pdf
- http://europeanprofservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/16147d52f5a8f6---66807688728.pdf
- http://toyotaprius-custom.com/js/upload/files/80886151700.pdf
- http://www.chp.pl/ckfinder/userfiles/files/jemafit.pdf
- http://adhunikjewellers.com/ckfinder/userfiles/files/nukadikekoteveb.pdf
- http://dirpub.org/editor/ckfinder/userfiles/files/93263983048.pdf
- https://lostsoulsmemorialnj.org/wp-content/plugins/super-forms/uploads/php/files/fe5dfbde86c8f871848d7468ed38956e/35281312563.pdf
- https://www.libyamonitor.com/sites/all/libraries/ckfinder/userfiles/files/87292706146.pdf
- https://sandalyecenneti.com/wp-content/plugins/super-forms/uploads/php/files/caavu8htlun8be2tuq5qk2c5kp/76084641782.pdf
- http://arenda-v-novosibirske.ru/ckfinder/userfiles/files/sixivinog.pdf
- http://quetthe.com/upload/files/57572771405.pdf
- https://bilbox.es/wp-content/plugins/super-forms/uploads/php/files/c85de80a73b77873d47ecb93ac227f65/viwufupigemi.pdf
- http://tdvvietnam.vn/webroot/img/files/kegesitezazolura.pdf
Embedded domains
- feedproxy.google.com
- praktijk.zorglink.nl
- gillsandgeckos.com
- ckv-siemreap.org
- andreevmag.com
- unitedfightalliance.jordanadams.com
- gingerwooddesign.com
- mymovingestimate.com
- imapcb.org
- ikra-ekb.ru
- sadhankendra.org
- cwesp.biz
- europeanprofservices.com
- toyotaprius-custom.com
- www.chp.pl
- adhunikjewellers.com
- dirpub.org
- lostsoulsmemorialnj.org
- www.libyamonitor.com
- sandalyecenneti.com
- arenda-v-novosibirske.ru
- quetthe.com
- bilbox.es
- marblobaths.ph
- tdvvietnam.vn
Embedded IP addresses
- 135.233.95.80
- 72.145.35.97
- 20.42.65.93
- 72.145.35.106
- 72.145.35.96
- 85.210.193.152
- 20.184.175.18
- 52.123.252.242
- 52.110.12.40
- 52.110.12.3
- 4.230.171.124
- 57.154.63.210
- 135.232.92.97
- 20.42.73.24
- 72.145.35.105
- 52.148.114.188
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report