MALICIOUS — e60a579e062866bdcc76010437115046b616729f24119c6c4751feb41f7c24f4

MALICIOUS — e60a579e062866bdcc76010437115046b616729f24119c6c4751feb41f7c24f4 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: e60a579e062866bdcc76010437115046b616729f24119c6c4751feb41f7c24f4
SHA-1: 9197999c94dff8923a4547972e68d17ec18926f2
MD5: e5bc6be01fb46ee1840118a54e9915f5
ssdeep: 1536:P8JdiHDnMCBptCabAba4qemWGpOKCW4SpvwHhxH2yBT8z:iCBptRboa4qAK+ivixtc
TLSH: T12B37D0F340CBDE5C775AEB07ACFA1199448EE74452A2E7A1408CB6ACA0BC57DBF00941
Submitted as: e60a579e062866bdcc76010437115046b616729f24119c6c4751feb41f7c24f4
File type: pdf · Size: 69723 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://kfgame.snailgame.ru/upload/files/20210921092804.pdf - network signal, weight 0.70, confidence 0.80
Contacted 18 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://coretry.ru/uplcv?utm_term=world+war+2+apk+mod, http://kfgame.snailgame.ru/upload/files/20210921092804.pdf, https://takipcisec.com/calisma2/files/uploads/8904850529.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9775 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 7cee70b6bff4b2571d50704bcd6f118ab4bc817b7ba1e44098dec89328248f66
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\90e192d98bb9a92def6cc8d8f98bc791.png - 268204e47c40b5b775698556d4ca2c3504c9684ce5ead7e6a36ae5c2cfad61bb
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://coretry.ru/uplcv?utm_term=world+war+2+apk+mod
http://kfgame.snailgame.ru/upload/files/20210921092804.pdf
https://takipcisec.com/calisma2/files/uploads/8904850529.pdf
http://toanthinh.vn/webroot/img/files/befakunakixunobatuxoju.pdf
http://offerseir.com/basefile/offerseircom/files/50693681752.pdf
http://turningpointdigital.com/cote_dor_import/admin/ckfinder/userfiles/files/20945781590.pdf
http://www.oknookna.pl/wp-content/plugins/formcraft/file-upload/server/content/files/1614e99b1c5a36---mixevodapisubaz.pdf
http://hkacca.com/userfiles/80520803386.pdf
http://balade-pierry.fr/userfiles/file/41470168561.pdf
https://landtop.com/filespath/files/20210929061125.pdf
http://bookblog.kr/data/file/files/zupufos.pdf
http://vigen12.com/userfiles/file/woxonotudagi.pdf
http://geofer.eu/userfiles/files/nafovisemugosojedajeteve.pdf
https://www.carlosfunes.es/wp-content/plugins/formcraft/file-upload/server/content/files/16136cd4a3b8c2---91281657923.pdf
https://treasurehunterdetectors.solar-ovens.net/ckfinder/userfiles/files/risalos.pdf
https://buka.ru/sadm_files/zevusumekekevakopegegejus.pdf
http://impressivetravelvietnam.com/upload/files/84498464496.pdf
http://tantusmarina.com/UserFiles/file/zaxutejebamepazera.pdf
https://www.channeloflove.com/ckfinder/userfiles/files/93993846807.pdf
https://talaa-obour.com/webmisr/uploadwebmisr/file/58818204136.pdf
http://www.hcibatiment.fr/wp-content/plugins/formcraft/file-upload/server/content/files/1613b929425ed2---26651212326.pdf
http://andrelandberg.com/userfiles/file/87919968300.pdf
https://washlounge.in/ckfinder/userfiles/files/2211154165.pdf
http://kocavietnam.com/upload/files/depomuli.pdf
https://kurishupally.org/userfiles/file/wubonefu.pdf

Embedded domains

coretry.ru
kfgame.snailgame.ru
takipcisec.com
offerseir.com
turningpointdigital.com
www.oknookna.pl
hkacca.com
balade-pierry.fr
landtop.com
bookblog.kr
vigen12.com
geofer.eu
www.carlosfunes.es
treasurehunterdetectors.solar-ovens.net
buka.ru
impressivetravelvietnam.com
tantusmarina.com
www.channeloflove.com
talaa-obour.com
www.hcibatiment.fr
andrelandberg.com
washlounge.in
kocavietnam.com
kurishupally.org
www.w3.org

Embedded IP addresses

51.11.192.50
40.84.85.40
52.110.12.14
4.230.171.124
20.247.184.197
13.89.179.12
135.233.95.144
40.103.64.226
74.178.240.61
52.123.128.14
135.234.160.246
52.123.252.246
135.233.95.80
203.26.79.13
92.223.78.30
20.42.179.204
52.168.117.170
20.42.73.26

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report