MALICIOUS — ea0046f60d229ded647e1cb7378f9ed5a23dbc21662f07b4d087520abe676470
MALICIOUS — ea0046f60d229ded647e1cb7378f9ed5a23dbc21662f07b4d087520abe676470 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 50 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
ea0046f60d229ded647e1cb7378f9ed5a23dbc21662f07b4d087520abe676470 - SHA-1:
ba6c86476c5ea4b3bd896b42c676a6bbed0c32b2 - MD5:
04d6a1d919c903ab0308ecc8528fee2f - ssdeep:
1536:+NUK9eXagaTFU+VPZhkOFU5MrKMLObaUk0AN0CisxXXWCpOVibUhW2QblpL9zKv7:MeaJU+P8OFUxBJANrisxwViArGpRzA - TLSH:
T1C339CFF310D7ED5CBBCE8F0369BB11A9E04BE6C42121B7504188B96CD97CABD6A14A11 - Submitted as: ea0046f60d229ded647e1cb7378f9ed5a23dbc21662f07b4d087520abe676470
- File type: pdf · Size: 84468 bytes
- Verdict: malicious (99/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 9 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Dropped a malicious payload (Lazarus): root_.cache_dconf_user - dynamic signal, weight 0.80, confidence 0.90
- Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule
HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85 - Embedded link rated suspicious by URL analysis: http://marsalanoleggio.it/userfiles/files/5055512064.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: http://houselandia.ru/files/28973791164.pdf, http://fatfailogistics.com/fckeditor/files/file/35595214496.pdf, http://tatagz.com/uploadfile/files/75980987838.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Contacted 5 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
986 behavior events · 0 ATT&CK techniques · 2 dropped files.
Runtime network
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- ntp.ubuntu.com
- 250.255.255.239.in-addr.arpa
- desktop-hsgcbep
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 224.0.0.251
- ff02::fb
- ff02::1:3
- 224.0.0.252
- 74.179.71.159 US · Moses Lake · AS8075 Microsoft Corporation
- 10.240.0.1
- 10.240.0.255
- ff02::16
- 169.254.255.255
- 239.255.255.250
- 91.189.91.157
- ff02::1:ff12:3456
- 135.232.92.137 US · Boydton · AS8075 Microsoft Limited
Dropped files
- root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7 - tmp_tmp.pxmkREXT62 -
44cc97a8a2e994395d8e598311d1bcf5f522e5e87a75104c116c5e00cb42c077
Embedded URLs
- https://feedproxy.google.com/~r/Uplcv/~3/zMnd8XtcwSM/uplcv?utm_term=young+thug+ft+ti+about+the+money+mp3+download
- http://houselandia.ru/files/28973791164.pdf
- http://fatfailogistics.com/fckeditor/files/file/35595214496.pdf
- http://tatagz.com/uploadfile/files/75980987838.pdf
- http://marsalanoleggio.it/userfiles/files/5055512064.pdf
- http://horizonpestservices.com/userfile/kutezadatuvidatewimokipa.pdf
- http://medeeatour.ro/mm/file/nozeguradifilisirizu.pdf
- http://hangquangauto.com/files/72971366429.pdf
- http://elliptical-trainers.ru/ckfinder/userfiles/files/talusepuzifok.pdf
- https://www.agro-zavod.ru/app/webroot/js/ckfinder/userfiles/files/83364940817.pdf
- http://baloneacessorios.com/_upload/file///73381054990.pdf
- https://mycocoa.org/images/upload/files/32571060203.pdf
- http://boilerservis.ru/uploads/files/farorokolamudaxo.pdf
- https://dmshospital.com/mm_engg/files/4638093983.pdf
- http://abwpetersburg.com/uploads/files/xaperulujasis.pdf
- http://school15-tyumen.ru/f/70927137748.pdf
- http://www.reroofingbrisbaneqld.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/16134271369004---mokobowaletiramizutepa.pdf
- https://hobbes-group.com/upload/files/60615068321.pdf
- http://albertopizzetti.it/userfiles/files/wexik.pdf
- http://reklama-v-sochi.com/ckfinder/userfiles/files/98915456657.pdf
- https://fminterativa.net/cms/plugins/ckfinder/userfiles/files/98529540168.pdf
- http://defhjdr.friend-match.com/upload/files/doridumo.pdf
- http://balatonfurediallatorvos.hu/userfiles/file/33882708419.pdf
- http://www.neslihanonur.com/wp-content/plugins/super-forms/uploads/php/files/fa5cbe02e8ce8778c2e1065d4859bafc/13298178535.pdf
- https://drahmetbostanci.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614298b9879db---zijozulofotogukupabin.pdf
Embedded domains
- feedproxy.google.com
- houselandia.ru
- fatfailogistics.com
- tatagz.com
- marsalanoleggio.it
- horizonpestservices.com
- hangquangauto.com
- elliptical-trainers.ru
- www.agro-zavod.ru
- baloneacessorios.com
- mycocoa.org
- boilerservis.ru
- dmshospital.com
- abwpetersburg.com
- school15-tyumen.ru
- www.reroofingbrisbaneqld.com.au
- hobbes-group.com
- albertopizzetti.it
- reklama-v-sochi.com
- fminterativa.net
- defhjdr.friend-match.com
- www.neslihanonur.com
- drahmetbostanci.com
- swaptoys.org
- argentum.com
Embedded IP addresses
- 74.179.71.159
- 135.232.92.137
- 149.154.167.99
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report