MALICIOUS — e216e4c6b9335e47bc67fa0dcba0b777c20e6cb7ce59016666154a2e470c72fe

MALICIOUS — e216e4c6b9335e47bc67fa0dcba0b777c20e6cb7ce59016666154a2e470c72fe is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: e216e4c6b9335e47bc67fa0dcba0b777c20e6cb7ce59016666154a2e470c72fe
SHA-1: e2b2cda5ac7e3019710bae6e0c66b9d6ea077697
MD5: 649bcd83cfd7a3f4a9297de3e35f2951
ssdeep: 1536:PMDLkvWkxZdEvLwFzEBvxcPJjtwQd11cgIWkstcFz5WYpO2L8eNGJPBmKV/WhLCd:Aye8FgvyPJTd117IWGM2LOPB5VVQWZ
TLSH: T1F639E1B3655FDD8C765B9F13BAA61568708AF3C43131AA6440847A2C89BC1FDBF40D60
Submitted as: e216e4c6b9335e47bc67fa0dcba0b777c20e6cb7ce59016666154a2e470c72fe
File type: pdf · Size: 90072 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://targhevaticane.it/userfiles/files/80468671024.pdf - network signal, weight 0.70, confidence 0.80
Contacted 21 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://avigailpekelman.com/sites/default/files/file/ruzunezikatikuxaxan.pdf, https://massagetheory.ca/wp-content/plugins/super-forms/uploads/php/files/d87e0a31403361a32bc18f079e24c641/91615318805.pdf, https://eventpro-kontraktorpameran.com/uploaded/files/83962369070.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (17 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9680 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
WORKGROUP
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787796067&P2=404&P3=2&P4=LyqRmDl6vnq0LlXOtZ5RDVGoU%2bbU2Iws80wJLhb2QZAWzVxPeeRYUXgJdURerFA0Zhmw30FwZXuaDM%2bZbIdktw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787796104&P2=404&P3=2&P4=e0PF50TPV4%2bsC6v9N0knJ6sZnOjVPnvDye0ID3uqkQI9rjSxzl08Ikn75MNJzqViW4rU98kAD8vYf57GkPTBkg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - dbe35b3786feab87ca658fd5038a6e04aed342e9c4c604c8e26ace4aa786053b
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\9ee8fba66e723cd8ae5e59ea39bc89e3.png - a7e5f79192edf0dcd0ae2de66ff8ed7e3b6ed07ef2116f17cebf391a7cdaba48
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/FevRqgeaUVY/uplcv?utm_term=nfa+minecraft+accounts+free
https://avigailpekelman.com/sites/default/files/file/ruzunezikatikuxaxan.pdf
https://massagetheory.ca/wp-content/plugins/super-forms/uploads/php/files/d87e0a31403361a32bc18f079e24c641/91615318805.pdf
https://eventpro-kontraktorpameran.com/uploaded/files/83962369070.pdf
http://targhevaticane.it/userfiles/files/80468671024.pdf
http://hokkaido-love87.com/app/webroot/js/ckfinder/userfiles/files/94926346612.pdf
https://totalmediasolutions.ae/ckfinder/userfiles/files/tajifugu.pdf
http://bn-biz.com/userData/board/file/bosolomoputirixi.pdf
http://levakov132.ru/userfiles/file/40213427826.pdf
https://duel.pl/userfiles/file/36558871607.pdf
http://cappellastudio.it/userfiles/files/fefox.pdf
http://sensor4you.com/fckeditor/editor/filemanager/connectors/php/fckeditor/upload/202109/file/bibugedu.pdf
http://kfnmdg.com/upfolder/e/files/20210912070650.pdf
http://thanhcongtechtra.com/upload/files/jiwusov.pdf
http://dichvugiayphep.biz/upload/ck/files/95835877306.pdf
https://www.premiumtrade.ro/ckfinder/userfiles/files/33843766176.pdf
http://handsonmontessoripk.com/userfiles/files/74835595061.pdf
https://beautydent.hu/editor_up/61595377176.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt

Embedded domains

feedproxy.google.com
avigailpekelman.com
massagetheory.ca
eventpro-kontraktorpameran.com
targhevaticane.it
hokkaido-love87.com
bn-biz.com
levakov132.ru
duel.pl
cappellastudio.it
sensor4you.com
kfnmdg.com
thanhcongtechtra.com
dichvugiayphep.biz
handsonmontessoripk.com
www.w3.org
purl.org
ns.adobe.com
totalmediasolutions.ae
www.premiumtrade.ro
beautydent.hu

Embedded IP addresses

135.233.45.221
172.172.255.216
162.159.142.9
20.42.65.89
52.123.252.215
4.144.132.223
4.230.171.124
135.233.95.135
20.112.250.133
20.165.94.63
52.123.129.14
40.99.133.210
172.178.240.161
52.123.252.212
72.154.7.107
203.26.79.13
57.155.104.224
52.123.252.192
4.209.250.170
104.46.162.224
52.168.117.170

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report