MALICIOUS — e97f4ea2ef4f25f98645b3b2b58dc9cf8bd6ae630d3dbd1a43c62757283a9cff

MALICIOUS — e97f4ea2ef4f25f98645b3b2b58dc9cf8bd6ae630d3dbd1a43c62757283a9cff is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: e97f4ea2ef4f25f98645b3b2b58dc9cf8bd6ae630d3dbd1a43c62757283a9cff
SHA-1: 9986fd00ce624429a306645777c21b5905809205
MD5: 55d8d4a645798ce8831d316ae7ef567d
ssdeep: 1536:1R/+6NKrfojqzrilNN+ZTVeijGh1+TIKvUJXWq2YqADhMIE9zzUFWspO2Ss9M:6DfDCQ3eiIsPvUJPbMIE9XUs212
TLSH: T18838C0F32193ED9C77868F4329EA262991C9EBCC61235B501489FA6CD07CA7CBF00552
Submitted as: e97f4ea2ef4f25f98645b3b2b58dc9cf8bd6ae630d3dbd1a43c62757283a9cff
File type: pdf · Size: 84028 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://stagelight.pl/userfiles/files/21439467486.pdf - network signal, weight 0.70, confidence 0.80
Contacted 17 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://prime-standard.com/piceditor/file/fakopazogipidinit.pdf, https://assignmentmart.com/ckfinder/userfiles/files/xenibubejijasenakunuki.pdf, https://dedywiredja.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614d0fa541908---83067221612.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9634 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
_dosvc._tcp.local
ntp.ubuntu.com
desktop-hsgcbep
250.255.255.239.in-addr.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 52d8a7303e5fe0bd2783c30768ff398b949db192ef1b2562a58d22a345dec269
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\60c3befd676368e9840f79da04209108.png - 6b2cb11050bfa6d6f667256ae7a92b6d1ad7ae33239a5c534f2755b73415a275
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/fzgW7-mxBc0/uplcv?utm_term=the+angle+with+laura+ingraham
http://prime-standard.com/piceditor/file/fakopazogipidinit.pdf
https://assignmentmart.com/ckfinder/userfiles/files/xenibubejijasenakunuki.pdf
https://dedywiredja.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614d0fa541908---83067221612.pdf
http://stagelight.pl/userfiles/files/21439467486.pdf
https://pensiunea-escape.ro/ckfinder/userfiles/files/xuzodekidipodokoniwaj.pdf
https://music-group-store.com/upload/files/koduwojunoreparu.pdf
https://31app.com/userfiles/file/32897799864.pdf
http://krukewittfarms.com/userfiles/file/52353977812.pdf
https://bringem.de/wp-content/plugins/super-forms/uploads/php/files/086dcb5a16235d02ca22e445befe4e10/39000361989.pdf
https://avis-medical.ma/wp-content/plugins/super-forms/uploads/php/files/48e86183b718c23648e1b972cb5b27de/78843915378.pdf
http://oxigensupplies.com/shipinc/userfiles/files/xepogexo.pdf
https://baxsporthorses.nl/userfiles/file/93181158876.pdf
http://infoegrafica.com/userfiles/files/topifulesa.pdf
https://rh-h1tapi-turbo.com/contents/files/wozuwususibelid.pdf
http://hondatayho.vn/images/ckeditor/files/51653722727.pdf
https://dalycity.com/wysiwygfiles/file/tijawejuwimi.pdf
http://omatsuri.kr/data/userfiles/files/21975761475.pdf
http://sartoriaventurini.com/userfiles/files/tuvefuzo.pdf
http://peak-experience-europe.com/images/blog/file/76425743582.pdf
http://webinaris.eu/ckfinder/userfiles/publics/files/gejujonigiwizod.pdf
http://taemyung.com/data/upload/file/zuvezijulat.pdf
https://kcharp.com/ckfinder/userfiles/files/zigukowobariw.pdf
http://xhiehchin.com/Xhieh_News/_file/20280579104.pdf
http://balony.dmuchance.eu/userfiles/file/xifepubolojun.pdf

Embedded domains

feedproxy.google.com
prime-standard.com
assignmentmart.com
dedywiredja.com
stagelight.pl
music-group-store.com
31app.com
krukewittfarms.com
bringem.de
oxigensupplies.com
baxsporthorses.nl
infoegrafica.com
rh-h1tapi-turbo.com
dalycity.com
omatsuri.kr
sartoriaventurini.com
peak-experience-europe.com
webinaris.eu
taemyung.com
kcharp.com
xhiehchin.com
balony.dmuchance.eu
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

20.50.73.14
52.168.117.170
172.172.255.216
20.184.175.19
4.247.188.233
52.110.12.38
4.230.171.124
52.230.60.54
4.150.223.99
74.179.77.204
52.123.129.14
40.104.4.2
74.178.76.44
203.26.79.13
4.209.250.170
4.207.44.75
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report