MALICIOUS — e5666468d30e8edaf57d80d5e8d2b53512374efd00097de5bbb70ebbf63ffa52

MALICIOUS — e5666468d30e8edaf57d80d5e8d2b53512374efd00097de5bbb70ebbf63ffa52 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: e5666468d30e8edaf57d80d5e8d2b53512374efd00097de5bbb70ebbf63ffa52
• SHA-1: 2c624748bf8db5709c45bbad2875b48064049270
• MD5: 0a72bbd16aa1e3d23895df77ebb85be6
• ssdeep: 1536:AaXJ08In/GBe0W86fsT2tGRhiTadVZBz6I9Y/R:LZ/g8IsKTQZZN9YR
• TLSH: T17A37E0F3908BDE9D95D36F53AEB90459708BE68420A3E77448C8B66DC0FC67D6E01A01
• Submitted as: e5666468d30e8edaf57d80d5e8d2b53512374efd00097de5bbb70ebbf63ffa52
• File type: pdf · Size: 70142 bytes
• Verdict: malicious (98/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!0A72BBD16AA1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1105
• T1566.002

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated malicious by URL analysis: http://peaceinsrilanka.lk/userfiles/file/ridepejipisan.pdf - network signal, weight 0.70, confidence 0.80
• Contacted 19 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
• Embedded network infrastructure: https://alcc.vn/wp-content/plugins/super-forms/uploads/php/files/e3r1rpre0u92k8tgtjvc687vi7/legenamerasagot.pdf, http://salonlomi.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16081da3898684---46085276085.pdf, http://copy2d.com/ftp/image/file/34699222143.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Extracted generic config (15 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9666 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• ntp.ubuntu.com
• 250.255.255.239.in-addr.arpa
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787847971&P2=404&P3=2&P4=cMH8G5UARUXal88%2fWQU7s3CLYIIaKeGDOF05fpHfPH6LeNqf4%2bQZRBX4997p1iLFtHKgGQplVEcT8SCfrtTqUw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

• C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 6ba03200b213d5784d9fbf1c70db7aa3c9e84afbd81b7c5470e518d09111193c
• C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\b919c4d82a8e419ba1f387ca920baedf.png - d906624fa8232a6f106c363ec521369433dbcd3ee2a2aa3d8c64effd59a9c458
• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/6naE_Nh8_CY/uplcv?utm_term=addition+of+vectors+worksheet+answers+physics+classroom
• https://alcc.vn/wp-content/plugins/super-forms/uploads/php/files/e3r1rpre0u92k8tgtjvc687vi7/legenamerasagot.pdf
• http://salonlomi.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16081da3898684---46085276085.pdf
• http://copy2d.com/ftp/image/file/34699222143.pdf
• http://ipvoicenj.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607dedf7bb20f---nogukofasufa.pdf
• http://www.abcklima.hu//data/editorfile/vutiwidiwogisajifuvenigon.pdf
• http://bagpack.com.np/wp-content/plugins/formcraft/file-upload/server/content/files/1608133e65b85e---68809528149.pdf
• http://www.commandinglife.com/wp-content/plugins/formcraft/file-upload/server/content/files/160966e7f36841---85979451773.pdf
• http://peaceinsrilanka.lk/userfiles/file/ridepejipisan.pdf
• http://www.1atlanticfunding.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608060ab65011---21064899982.pdf
• https://www.pferde-fuer-unsere-kinder.de/wp-content/plugins/formcraft/file-upload/server/content/files/16084ae4b93492---gosozege.pdf
• https://monacollection.ua/wp-content/plugins/super-forms/uploads/php/files/1ae8f4bcee5bde8d963a621d9c0d2706/denadudilovarebadoxonub.pdf
• http://www.norestim.ro/wp-content/plugins/formcraft/file-upload/server/content/files/16075a702d6879---kiwomanike.pdf
• http://www.publicitymailing.ie/wp-content/plugins/formcraft/file-upload/server/content/files/1607e63c8ef336---zivedubifefiwanezidu.pdf
• https://www.adler-leitishofen.de/wp-content/plugins/formcraft/file-upload/server/content/files/1606d49e573a61---45920884066.pdf
• http://www.yourhealthyourchoice.org/wp-content/plugins/formcraft/file-upload/server/content/files/160b6fcda85826---votirisuraxarowilisuki.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• feedproxy.google.com
• salonlomi.pl
• copy2d.com
• ipvoicenj.com
• www.commandinglife.com
• www.1atlanticfunding.com
• www.pferde-fuer-unsere-kinder.de
• monacollection.ua
• www.adler-leitishofen.de
• www.yourhealthyourchoice.org
• www.w3.org
• purl.org
• ns.adobe.com
• alcc.vn
• www.abcklima.hu
• bagpack.com.np
• peaceinsrilanka.lk
• www.norestim.ro
• www.publicitymailing.ie

Embedded IP addresses

• 135.233.95.144
• 135.234.160.245
• 52.123.252.193
• 52.110.12.8
• 4.230.171.124
• 4.144.132.223
• 85.210.193.152
• 74.178.76.128
• 20.76.201.171
• 52.123.128.14
• 40.99.134.2
• 74.179.71.159
• 72.145.35.105
• 203.26.79.13
• 52.123.252.224
• 92.223.78.30
• 4.150.223.111
• 48.200.63.27
• 51.105.71.137

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report