MALICIOUS — e77d82db66ae5ffe83286c6fcc52a9d691ccaa18da887e740582fc0c29074766

MALICIOUS — e77d82db66ae5ffe83286c6fcc52a9d691ccaa18da887e740582fc0c29074766 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: e77d82db66ae5ffe83286c6fcc52a9d691ccaa18da887e740582fc0c29074766
SHA-1: 267655d2dab59205c8e3b61b530696fb1a4c3d01
MD5: 64d11e4c6d73bdbde24696cc047d0bc6
ssdeep: 1536:bXjM+H+rYnApunMBRRMB2Ox/1MSEEGdXq7f4DYjq+GLhsECWspORGWwz6Zlov9LL:Hv+r4ApJHc2OJuEGd67fBO+GLCElRmzv
TLSH: T1FA37B0B3219BCD5CB79B5B0369BB1059B08AE7886537EF500444BB6CC47C1BEAF40A51
Submitted as: e77d82db66ae5ffe83286c6fcc52a9d691ccaa18da887e740582fc0c29074766
File type: pdf · Size: 74946 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://alconsprom.ru/ckfinder/userfiles/files/vofedojexiviguzo.pdf - network signal, weight 0.70, confidence 0.80
Contacted 15 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://wastran.ru/uplcv?utm_term=doga+comics+free+download, https://toananhmedical.com/uploads/files/45376212873.pdf, http://stphilomenaonline.org/userfiles/file/pezegifedowafogoma.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

10059 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 5436ea6aeb0ad9abaca855386942121fe14a10472176128f17d0fde3d8d3f620
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\99c4d6b11226314c5808ed66fb90d55a.png - 1c3696dd3ee7a9ca165d2b83160ef5e7a0515f35757c039b9852753af41b48ca
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://wastran.ru/uplcv?utm_term=doga+comics+free+download
https://toananhmedical.com/uploads/files/45376212873.pdf
http://stphilomenaonline.org/userfiles/file/pezegifedowafogoma.pdf
http://www.lifestaralberta.com/wp-content/plugins/formcraft/file-upload/server/content/files/16130dbbbc51cd---99592961790.pdf
http://nhatrangpalace.net/app/webroot/upload/files/17167618500.pdf
http://escolacaritas.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612fb0cfb8c31---bapapebiwogaridajuburixar.pdf
https://www.havanasalsa-dance-tours.com/wp-content/plugins/super-forms/uploads/php/files/ec034d09ae066d4598d938430172941a/28102668553.pdf
http://mabo-meccanica.eu/userfiles/files/66305031809.pdf
http://alconsprom.ru/ckfinder/userfiles/files/vofedojexiviguzo.pdf
https://uleiuri.ro/userfiles/file/30946325170.pdf
https://bangprice.com/bangprice.com/beta/cms_image/file/5264864264.pdf
https://www.kiteschule-eckernfoerde.de/wp-content/plugins/formcraft/file-upload/server/content/files/1613422bb4c6f3---suvavilorebileza.pdf
http://hcbarrett.com/user_area/file/7983865447.pdf
https://krassimirtaskov.com/userfiles/files/sarovudemupof.pdf
http://proallprint.com/userfiles/files/kamevuderowinatevisuwup.pdf
http://massvt.sk/editor_uploads/system/files/sives.pdf
https://gplacestracker.com/userfiles/file/niviwixi.pdf
https://n-zvuk.ru/upload/file/69634454136.pdf
http://mayepnuocmia.vn/data/ckfinder/files/52414899521.pdf
http://fuhua.tumujike.com/assets/upload/files/202109121812326138.pdf
https://vinniescustoms.com/userfiles/files/vibegojeboninagi.pdf
http://assisdrive.pt/userfiles/file/66494570078.pdf
http://sakurahoaanhdao.com/webroot/img/files/panugus.pdf
http://artikos.pl/userfiles/file/36581385471.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

wastran.ru
toananhmedical.com
stphilomenaonline.org
www.lifestaralberta.com
nhatrangpalace.net
escolacaritas.com
www.havanasalsa-dance-tours.com
mabo-meccanica.eu
alconsprom.ru
bangprice.com
www.kiteschule-eckernfoerde.de
hcbarrett.com
krassimirtaskov.com
proallprint.com
gplacestracker.com
n-zvuk.ru
fuhua.tumujike.com
vinniescustoms.com
sakurahoaanhdao.com
artikos.pl
www.w3.org
purl.org
ns.adobe.com
uleiuri.ro
massvt.sk

Embedded IP addresses

125.56.205.17
52.110.12.3
57.155.101.212
4.230.171.124
125.56.205.105
74.179.77.204
52.178.17.234
20.236.44.162
52.123.129.14
72.153.5.96
203.26.79.13
4.247.188.233
48.192.143.121
20.184.175.2
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report