MALICIOUS — e6f982a3fdbdbae2f6a52e74d7789aa75bf23c2935b0e8846094ab6644642459

MALICIOUS — e6f982a3fdbdbae2f6a52e74d7789aa75bf23c2935b0e8846094ab6644642459 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 5 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: e6f982a3fdbdbae2f6a52e74d7789aa75bf23c2935b0e8846094ab6644642459
SHA-1: ca21923f2fcfa8ff310a76f03d003c1b0a4306cb
MD5: b98cfc847d6243c51e2dba6fb8686f28
ssdeep: 1536:EjunnWbXUpr7AGIIACdMAJR/kG/MIQkNqZ+NC8M+S6ukrXxRDm:0kiXs3ddzf/kG/MIxqOI+pusXxY
TLSH: T11938E1F352C7DD4C7A67AB177AA204797147C3587037BAA8009CB639D5AC2BF6E20910
Submitted as: e6f982a3fdbdbae2f6a52e74d7789aa75bf23c2935b0e8846094ab6644642459
File type: pdf · Size: 83706 bytes
Verdict: malicious (99/100)

Detections (5 of 54 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!B98CFC847D62
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged PDF/Phish-FAB!B98CFC847D62 (rule PDF/Phish-FAB!B98CFC847D62) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://oniceh.ru/uplcv?utm_term=butterfly+lovers+violin+solo+sheet+music+free, https://pilotcenter.gr/wp-content/plugins/super-forms/uploads/php/files/o777t311snqkcdj1ep1n5jhgq8/ribopisafufozupe.pdf, https://toskov-yordanov.com/userfiles/file/28341480202.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Contacted 9 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

1071 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
23.40.52.85
23.11.37.157
20.190.167.21
192.168.122.105
4.150.223.100 US · Des Moines · AS8075 Microsoft Corporation
150.171.22.17
23.33.238.178
52.110.12.32 AU · Sydney · AS8075 Microsoft Corporation
4.230.171.124 KR · Seoul · AS8075 Microsoft Corporation
23.33.238.173
104.18.33.89 US · San Francisco · AS13335 Cloudflare, Inc.
52.230.59.222 SG · Singapore · AS8075 Microsoft Corporation

Dropped files

root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://oniceh.ru/uplcv?utm_term=butterfly+lovers+violin+solo+sheet+music+free
https://pilotcenter.gr/wp-content/plugins/super-forms/uploads/php/files/o777t311snqkcdj1ep1n5jhgq8/ribopisafufozupe.pdf
https://toskov-yordanov.com/userfiles/file/28341480202.pdf
http://www.kissdocs.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1607ce3c82fe49---78414944726.pdf
https://homini.eu/wp-content/plugins/formcraft/file-upload/server/content/files/1608566fd8f346---gikedewipowabob.pdf
https://luxmarketing.agency/wp-content/plugins/super-forms/uploads/php/files/ncn90plca0i3bhj38rc4vr96r7/99110369183.pdf
http://amadpich.com/userfiles/file/jaledubofesefowarulufume.pdf
http://amirafouad.com/uploaded_files/file/miluraxafo.pdf
http://anhuishangbiao.com/upload_fck/file/2021-6-8/20210608231117985196.pdf
http://nek.ua/wp-content/plugins/formcraft/file-upload/server/content/files/160b9bf6210116---88099855756.pdf
http://www.marsagri.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075738fe7474---jadofijuwololig.pdf
http://aimic.com/userfiles/file/milifanomatiro.pdf
https://1sis.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609887bba306c---guzujekefaxuzav.pdf
https://jamiatulbanat.in/wp-content/plugins/formcraft/file-upload/server/content/files/1606cc33aded86---zemomopaxemuze.pdf
https://endoaccessories.com/wp-content/plugins/super-forms/uploads/php/files/vih2aj0tf7nf22l4lpk2q4kv8h/lovosiker.pdf
https://saraelv.no/wp-content/plugins/formcraft/file-upload/server/content/files/1609ba99156e2d---sevukusanarivak.pdf
http://aaaexpressheating.com/userfiles/file/42846984861.pdf
https://www.drserapkagan.com/wp-content/plugins/super-forms/uploads/php/files/9sm5a23m2nhnroskdvrarettg7/14496635682.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt

Embedded domains

oniceh.ru
toskov-yordanov.com
www.kissdocs.com.au
homini.eu
amadpich.com
amirafouad.com
anhuishangbiao.com
nek.ua
www.marsagri.com
aimic.com
1sis.com
jamiatulbanat.in
endoaccessories.com
saraelv.no
aaaexpressheating.com
www.drserapkagan.com
www.w3.org
purl.org
ns.adobe.com
pilotcenter.gr
luxmarketing.agency

Embedded IP addresses

20.42.179.192
4.150.223.100
52.110.12.32
4.230.171.124
104.18.33.89
52.230.59.222
74.178.240.51
135.232.92.137
92.223.78.30

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report