MALICIOUS — e3c6966418af4f2c2247b357e3327b835986365e2588e9d9adc47ce29e5bf36a

MALICIOUS — e3c6966418af4f2c2247b357e3327b835986365e2588e9d9adc47ce29e5bf36a is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: e3c6966418af4f2c2247b357e3327b835986365e2588e9d9adc47ce29e5bf36a
SHA-1: 00102a53ca4a05c72ecd89481256b60b2b5dc55a
MD5: 5ffecf3f42487d3d20bb845b39187579
ssdeep: 1536:4Gp0wfkBKDM6zaTnjwPQGAIp7pfHizCZtbGYREWOpOaZRVW/HjALRVwmo:CwHYZ/wPQGxxcCZbaZRyjALRg
TLSH: T17838DFF31097ED9C77879F03A8AB1198714AE7C87861EBA0518D736C847C5BEBE00951
Submitted as: e3c6966418af4f2c2247b357e3327b835986365e2588e9d9adc47ce29e5bf36a
File type: pdf · Size: 79573 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://smwiarus.pl/ckfinder/userfiles/files/pozirusuzigonudotuki.pdf - network signal, weight 0.70, confidence 0.80
Contacted 19 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://bumsnab.ru/uploads/files/42152212220.pdf, http://smwiarus.pl/ckfinder/userfiles/files/pozirusuzigonudotuki.pdf, https://muzpony.de/obrazki/file/18614836623.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9737 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
_dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - be79591d2fb757ebc5e6b6fcb1504b138b5274df0b45740ebdacc2453aa3245f
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\f2126228d5aaa686c7fb38983e79f155.png - ec471bd23bd1283370c44489868341a7627aa60a768db0bc93e2f3b540981596
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

http://feedproxy.google.com/~r/Xvkpad/~3/oscUj7J0Gjw/uplcv?utm_term=160+pounds+to+us+dollars
http://bumsnab.ru/uploads/files/42152212220.pdf
http://smwiarus.pl/ckfinder/userfiles/files/pozirusuzigonudotuki.pdf
https://muzpony.de/obrazki/file/18614836623.pdf
http://carnow.jp/js/upload/files/fazuboxagivigejebolerewu.pdf
https://thaodienland.com/fckeditor/editor/filemanager/connectors/php/temp/file/jojixojivanez.pdf
http://a-mega.ua/images/uploads/file/gibobifo.pdf
http://saikunghouse.hk/userfiles/taderozemixigana.pdf
http://cargo3030.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16156a4cbeca3e---fidiwar.pdf
http://forum-auto.ru/data/files/xitaluputosal.pdf
http://yameitecl.com/ckfinder/userfiles/files/20210910_124725.pdf
http://razzledazzleevents.in/userfiles/file/nowomakesewevor.pdf
https://sd-olimp.hr/files/5893656891.pdf
http://nagymester.com/userfiles/file/90202056572.pdf
http://www.heksan.com.pl/file/newavani.pdf
http://namjapizza.com/app/webroot/files/88503444533.pdf
http://creativetechno.in/userfiles/file/mututenodaxosevijazi.pdf
https://asset-books.com/userfiles/file/dugisilebovafot.pdf
http://aqbnb.com/uploadfile/file/vevetawojewobugopusive.pdf
https://braveathlete.net/geektic/files/tolafatamesugojapuzadupil.pdf
http://grandfiltr.com/files/file/35566731598.pdf
http://nineslash.com/user_file/file/saludosikokuzaw.pdf
http://www.pratikchoudhury.com/fckimages/file/46966718061.pdf
http://sake-tori.com/images/library/File/nidunukanatifikomu.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

feedproxy.google.com
bumsnab.ru
smwiarus.pl
muzpony.de
carnow.jp
thaodienland.com
a-mega.ua
saikunghouse.hk
cargo3030.ru
forum-auto.ru
yameitecl.com
razzledazzleevents.in
nagymester.com
www.heksan.com.pl
namjapizza.com
creativetechno.in
asset-books.com
aqbnb.com
braveathlete.net
grandfiltr.com
nineslash.com
www.pratikchoudhury.com
sake-tori.com
www.w3.org
purl.org

Embedded IP addresses

74.178.76.128
52.123.252.243
4.150.223.104
52.230.59.222
52.110.12.54
52.110.12.50
57.154.63.210
4.230.171.124
20.165.94.63
13.69.116.104
135.233.95.144
40.99.134.2
52.123.128.14
20.165.94.46
203.26.79.13
92.223.78.30
4.150.223.96
104.208.16.94
20.42.73.28

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report