MALICIOUS — 49944593004.pdf

MALICIOUS — 49944593004.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: e3b66a5125e5eaa025308ea71763c3f5d797d64447080ed7cdcce853ab81dd95
SHA-1: a1e0f3588f4c09c45275ac8a738473835a447cd9
MD5: 3128cec514c7771f0c0f7373a941b185
ssdeep: 1536:TRinV3KeyfpkPjMqg3NnwUAHO6BZD22WBf0HFHy+Vmb//msvVvuS:TSMeGpnVFAHdBI2WBf0lcT/1Vv
TLSH: T16238D0F36117DC4C7E47AF47ADE6216E208AC74A2232F6684484BA2CD4BC77C6F64512
Submitted as: 49944593004.pdf
File type: pdf · Size: 82434 bytes
Verdict: malicious (98/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!3128CEC514C7
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://www.tecnotrefg.it/wp-content/plugins/formcraft/file-upload/server/content/files/16088278a1a7dc---mamibanurimexo.pdf - network signal, weight 0.70, confidence 0.80
Contacted 28 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://laborke.ru/uplcv?utm_term=tamilrockers+isaimini+movies+2019+download, http://chukgoobok.com/files/fckeditor/file/jofuzupanuxelokubivugoji.pdf, http://northstarbaptisttyler.com/clients/a/a4/a4b4c2e389351fb2dee96c3f727c6a57/File/46371522594.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (15 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9574 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
250.255.255.239.in-addr.arpa
desktop-hsgcbep
ntp.ubuntu.com
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\f8f21cf3aaee1970317ff1e11620f404.png - 1c7348b79fb6f2c712c5d95ce105ec79220dc62ef76bb4884cf3238967f1dfb2
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 8f767cc82e71c06278f0784e3ac5664e02fdeac9c8a03ad2e34debedbb56180a
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://laborke.ru/uplcv?utm_term=tamilrockers+isaimini+movies+2019+download
http://chukgoobok.com/files/fckeditor/file/jofuzupanuxelokubivugoji.pdf
http://northstarbaptisttyler.com/clients/a/a4/a4b4c2e389351fb2dee96c3f727c6a57/File/46371522594.pdf
http://www.elsecretodelolivo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160803d7ddb60d---minezufaxejojugage.pdf
http://asalsold.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a5e544ac849---87379990607.pdf
https://ballestermultiservicios.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071da0f9d6f4---mubatibanobupek.pdf
http://www.tecnotrefg.it/wp-content/plugins/formcraft/file-upload/server/content/files/16088278a1a7dc---mamibanurimexo.pdf
https://www.web2business.pt/wp-content/plugins/formcraft/file-upload/server/content/files/1609a4505911db---14258468679.pdf
http://alemotta.com/resources/original/file/nuvulosemazadusopaxi.pdf
http://milcontabil.com.br/wp-content/plugins/super-forms/uploads/php/files/7aoiem7ndjpkvr3l032hiv2sp0/loziviv.pdf
https://www.aceitedeoliva.com/wp-content/plugins/super-forms/uploads/php/files/0ac0d2d6385342337ec1a0b711eb0974/gajokopesinipuli.pdf
http://www.sunarmisir.com.tr/wp-content/plugins/super-forms/uploads/php/files/uofsu337v6bgkmc2chevi1o902/51589368247.pdf
https://spencershaulageltd.co.uk/wp-content/plugins/super-forms/uploads/php/files/da6f8a65265152bea46387474772cfb0/jodoza.pdf
https://pabausa.org/wp-content/plugins/formcraft/file-upload/server/content/files/160c0ea2348101---99338158144.pdf
http://plusbateria.com/wp-content/plugins/formcraft/file-upload/server/content/files/160983f3c4fa54---suforema.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

laborke.ru
chukgoobok.com
northstarbaptisttyler.com
www.elsecretodelolivo.com
asalsold.com
ballestermultiservicios.com
www.tecnotrefg.it
alemotta.com
milcontabil.com.br
www.aceitedeoliva.com
spencershaulageltd.co.uk
pabausa.org
plusbateria.com
www.w3.org
purl.org
ns.adobe.com
www.web2business.pt
www.sunarmisir.com.tr

Embedded IP addresses

172.172.255.218
20.42.179.192
20.42.65.90
72.154.7.106
85.210.193.152
52.168.117.170
20.42.65.91
20.42.73.31
57.154.63.210
57.155.104.224
4.247.188.224
20.89.1.11
52.123.252.242
20.42.179.204
74.179.71.159
4.230.171.124
72.153.5.136
203.26.79.13
135.232.92.137
13.69.116.107
135.233.95.144
4.150.223.97
52.123.129.14
40.103.64.226
92.223.78.30

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report