MALICIOUS — e240057cf6919e165d719d486e43a6e45303102c273a73a3d4d93c5ff4712bbe

MALICIOUS — e240057cf6919e165d719d486e43a6e45303102c273a73a3d4d93c5ff4712bbe is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: e240057cf6919e165d719d486e43a6e45303102c273a73a3d4d93c5ff4712bbe
SHA-1: e49aa4e6baef5d6102d65e809213f4641e416fa0
MD5: 7c63fa88a08a6eca79c409a04c9e2f81
ssdeep: 1536:h9k4YSbNYG2U/dWxjcBB6NWY3nk9wS/vH+T0cN+DWOpOwrKWGDku7RR6+PmOJ4X9:fk4FbWGnuoBBU93nk9wMH+T0ylwrQDkr
TLSH: T19539E0F761D7DE8C73868F0369BA066DA084E7885271A59050C8B67CD5BCAFDBE00861
Submitted as: e240057cf6919e165d719d486e43a6e45303102c273a73a3d4d93c5ff4712bbe
File type: pdf · Size: 90712 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 17 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://oawebserver.com/piceditor/file/82037909224.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: http://schuetzenfest-hemeringen.de/ablage/userfiles/files/76650338255.pdf, http://quiltingacademy.info/fckeditor/userfiles/file/zimifoxomomuzir.pdf, https://il-gusto.com/images/file/nuxaluratuboraladedafisu.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9677 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
desktop-hsgcbep
250.255.255.239.in-addr.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 24b5d38c65d59b07a3fb65de1c42319378f6b3c20b80189dd4b5e29c391fa7c7
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\718b98483fef079bb3b4ab1c89e2ed92.png - 2b7def2dc8eb09c401abe93a948851e36b7041bea940e36685bd712277102939
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/zMnd8XtcwSM/uplcv?utm_term=how+to+read+free+books+on+kindle+app
http://schuetzenfest-hemeringen.de/ablage/userfiles/files/76650338255.pdf
http://quiltingacademy.info/fckeditor/userfiles/file/zimifoxomomuzir.pdf
https://il-gusto.com/images/file/nuxaluratuboraladedafisu.pdf
http://oawebserver.com/piceditor/file/82037909224.pdf
http://ambulatorioveterinariomariani.it/userfiles/files/8014993361.pdf
https://maconlux.lu/userfiles/files/ripesaporelegup.pdf
https://muahohangnhat.com/app/webroot/uploads/files/64206706259.pdf
http://thomasgearon.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/tafeko.pdf
http://careerpathrecruitment.com/swapscan/app/webroot/js/ckfinder/userfiles/files/pagikapamewivikoxed.pdf
https://cottonweb.net/userfiles/file/duzitogakake.pdf
https://florissantdesign.nl/docs/Image/file/telarupubukog.pdf
http://fatfailogistics.com/fckeditor/files/file/lomogubakudesuk.pdf
http://topnotchimports.com/ckfinder/userfiles/files/jimitefot.pdf
http://tech-in.info/bramy/userfiles/file/27957592138.pdf
https://www.larche-de-jules.fr/ckfinder/userfiles/files/fekopowitebetogosivozim.pdf
http://stphilomenaonline.org/userfiles/file/nalugefurewogikidukok.pdf
http://ordineveterinarireggioemilia.it/userfiles/files/mamaxikupevetig.pdf
http://nhakhoauytinhaiphong.com/upload/files/tegurawemavujaxu.pdf
https://aldwalia.com/userfiles/files/zunesukinubijisokulaxaji.pdf
http://skontrolsengineering.com/file_media/file_image/file/finarejub.pdf
https://pt2-turbo-j3t.com/contents/files/45804485326.pdf
http://phuvuongcorp.com/luutru/files/12870534253.pdf
https://mmeasar.com/mmeasarfiles/file/22062286764.pdf
https://intersat.lv/files/file/9896320822.pdf

Embedded domains

feedproxy.google.com
schuetzenfest-hemeringen.de
quiltingacademy.info
il-gusto.com
oawebserver.com
ambulatorioveterinariomariani.it
muahohangnhat.com
thomasgearon.com
careerpathrecruitment.com
cottonweb.net
florissantdesign.nl
fatfailogistics.com
topnotchimports.com
tech-in.info
www.larche-de-jules.fr
stphilomenaonline.org
ordineveterinarireggioemilia.it
nhakhoauytinhaiphong.com
aldwalia.com
skontrolsengineering.com
pt2-turbo-j3t.com
phuvuongcorp.com
mmeasar.com
xn--9w3b11kh5l.com
www.w3.org

Embedded IP addresses

40.79.163.155
52.123.252.213
57.154.63.210
4.230.171.124
74.178.76.54
74.178.76.128
20.231.239.246
20.165.94.63
52.123.129.14
52.123.128.14
40.103.64.242
203.26.79.13
74.179.71.159
135.233.45.221
48.199.12.1
4.150.223.103
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report