MALICIOUS — e60e28e35d53b61b88bc5ac8a5f41c004b3aa0b036a60947370a0d450a6c1efa

MALICIOUS — e60e28e35d53b61b88bc5ac8a5f41c004b3aa0b036a60947370a0d450a6c1efa is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: e60e28e35d53b61b88bc5ac8a5f41c004b3aa0b036a60947370a0d450a6c1efa
SHA-1: 654dc99c9201657f3ab9c39f3e7449164d99e331
MD5: e4fa91e755c467f5b6da712d41e809db
ssdeep: 1536:NH2Mzv/9KHQKkx9FRNUfnMdAfcgTngHEW4RdLZqyEr/TWY8Y1JMWspO2F47z:Pzv/wajNUcecgTnSAZqZ/TWs/2s
TLSH: T14838D0F7619BFDCC764797037DAA0178904EEB5912219AA04488FB7CC4BCABD7B00951
Submitted as: e60e28e35d53b61b88bc5ac8a5f41c004b3aa0b036a60947370a0d450a6c1efa
File type: pdf · Size: 77876 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 13 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://9262895.ru/ckfinder/userfiles/files/29508986317.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: http://9262895.ru/ckfinder/userfiles/files/29508986317.pdf, https://wangwangcamp.com/uploads/files/202109170118048227.pdf, http://855solution.com/htdocs/cljr/data/files/15567753112.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9614 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
123.133.221.23.in-addr.arpa
_dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - ee23aced49ae69e059a784d062877039d9186230beaa9ccd64ca426e96bc3ad5
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\5263245c24bcfbe1724c0ff70e850d42.png - d5b30ca5491eaf2d35ff8c9f3b0f421bbd5240775ce5de18e1746588b8e2d194
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

http://feedproxy.google.com/~r/Xvkpad/~3/7xhmvLXWVJc/uplcv?utm_term=draping+for+apparel+design+helen+joseph+armstrong+pdf
http://9262895.ru/ckfinder/userfiles/files/29508986317.pdf
https://wangwangcamp.com/uploads/files/202109170118048227.pdf
http://855solution.com/htdocs/cljr/data/files/15567753112.pdf
http://nzozkrowodrza.pl/uploads/editor/file/96644313562.pdf
https://lllk.ru/wp-content/plugins/super-forms/uploads/php/files/c983f3c9dd4404f33896d74e3b4f7bc0/kikobebamudipuparug.pdf
https://webmodels.studio/wp-content/plugins/formcraft/file-upload/server/content/files/16138e07b10030---75198421763.pdf
http://adoriantarla.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1615923a316669---89029050573.pdf
http://tdvvietnam.vn/webroot/img/files/rekixe.pdf
https://www.mozartcantat.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1615ca6aea2262---tapidu.pdf
https://inclinedigital.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613b9a181007c---xobizorelusep.pdf
http://predit.ru/admin/ckfinder/userfiles/files/dapovu.pdf
http://istihdamhaberleri.com/upload/ckfinder/files/72580535791.pdf
https://facades-et-traditions.com/actualites/file/gonenomevilizukadivo.pdf
http://www.cascinasorigherio.it/wp-content/plugins/formcraft/file-upload/server/content/files/1613c80255db38---genitapezuturopag.pdf
http://olympiad-bigben.ru/ckfinder/userfiles/files/filitolajama.pdf
https://netwindowvn.com/uploads/userfiles/file/7122826467.pdf
http://thegioichuyendong.info/app/webroot/upload/files/73541731486.pdf
https://www.lamuccacompany.com/wp-content/plugins/super-forms/uploads/php/files/bca4d77082d73b6f952747452ee80f73/jajamujezamarofaruwo.pdf
https://otomatcilarmetal.com/otomat/upload/files/60659197452.pdf
http://thedewakohchang.com/image/upload/File/7052692374.pdf
https://jbdclothiers.net/emailer/userfiles/file/risiwujarowofubunewovuru.pdf
https://blokhol.com/upload/files/38966930556.pdf
http://taigesw.com/upload/files/73999207811.pdf
https://edusfera.pl/upload/file/73618763652.pdf

Embedded domains

feedproxy.google.com
9262895.ru
wangwangcamp.com
855solution.com
nzozkrowodrza.pl
lllk.ru
www.mozartcantat.nl
inclinedigital.com
predit.ru
istihdamhaberleri.com
facades-et-traditions.com
www.cascinasorigherio.it
olympiad-bigben.ru
netwindowvn.com
thegioichuyendong.info
www.lamuccacompany.com
otomatcilarmetal.com
thedewakohchang.com
jbdclothiers.net
blokhol.com
taigesw.com
edusfera.pl
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

4.247.188.224
135.233.95.80
52.168.117.169
20.42.179.204
52.110.12.51
4.230.171.124
74.178.76.128
135.232.92.97
40.103.64.242
52.123.129.14
172.178.240.161
203.26.79.13
172.170.180.133

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report