MALICIOUS — ed660039c177d6166b1f26a09ed589202c88a3dc9d4a57dc619e5f4cf9b9eca3
MALICIOUS — ed660039c177d6166b1f26a09ed589202c88a3dc9d4a57dc619e5f4cf9b9eca3 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100). 5 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
ed660039c177d6166b1f26a09ed589202c88a3dc9d4a57dc619e5f4cf9b9eca3 - SHA-1:
2893399fabbe4111009219e311e91ed2e8c0ff1f - MD5:
d8b68a0af7e7c6ee56fcc88ba2312c09 - ssdeep:
1536:KAzXFGngVnM5fXKYWLFyrl+0jU7Xzx7dAxOBLKR/UQM7gRTPWx4:Xk5fKvyrA0jUP3AxQLSMJ7gpPv - TLSH:
T14B37E1F3929BED8CA555DB033DE7264D68C6C58CB3318A50548C7A6CC93CBEE6D10A11 - Submitted as: ed660039c177d6166b1f26a09ed589202c88a3dc9d4a57dc619e5f4cf9b9eca3
- File type: pdf · Size: 75318 bytes
- Verdict: malicious (95/100)
Detections (5 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Trellix Stinger (McAfee): PDF/Phish-FAB!D8B68A0AF7E7
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 95/100 is the fusion of 6 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Contacted 16 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://xajibur.ru/award?keyword=adding+and+subtracting+integers+activity+pdf, https://dunokosira.weebly.com/uploads/1/3/5/3/135349308/safolasorujulapo.pdf, http://vesedakowata.onlinewebshop.net/gufamesufoxuwit.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Extracted generic config (13 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
9662 behavior events · 0 ATT&CK techniques · 3 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- _dosvc._tcp.local
- ntp.ubuntu.com
- 250.255.255.239.in-addr.arpa
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787853047&P2=404&P3=2&P4=F%2f%2brl64elFEw7EBHTfVI%2f9U9uwFyJZRJUwB3LoiLUGgp8NQW%2baCKYENir8HeH3MXcMe76C%2boAHpKBNSmbnVNpQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787853066&P2=404&P3=2&P4=FVVjnmtrSMtTEX%2b9Fb618WGkwIa%2fNJChVjt4DPBbZ2%2fWX3uPKUzNnfalvGo9U7S82GGajIrejw%2b0eihZek8%2bfA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Dropped files
- C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt -
22b65f0c03656965a23489b48935409ad1166303f5e18bf3a2bc7705eadfce35 - C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\f1ec5383069d90e55bfbef47ada2d73b.png -
de18c50eca1c8ac9a9ce28afff63c0e523348668fdb4a94e8c375c7b52ffa48d - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://xajibur.ru/award?keyword=adding+and+subtracting+integers+activity+pdf
- https://dunokosira.weebly.com/uploads/1/3/5/3/135349308/safolasorujulapo.pdf
- http://vesedakowata.onlinewebshop.net/gufamesufoxuwit.pdf
- https://cdn.sqhk.co/rixutixim/jc7jchj/94065785399.pdf
- https://cdn.sqhk.co/xajegakagiz/a2Pnuhe/86152894921.pdf
- http://rejorevubirobu.sportsontheweb.net/words_of_encouragement_for_a_first_time_mom.pdf
- https://cdn.sqhk.co/livixugakuf/Ggcjgjb/age_of_world_wars_wiki.pdf
- https://cdn.sqhk.co/pexejaxer/gcmjgtw/delokopuvegulisadupojamo.pdf
- https://cdn.sqhk.co/lusimalifa/jXQghoy/spina_bifida_in_adults_surgery.pdf
- https://cdn.sqhk.co/noxobabidof/wibVJhb/download_20th_century_alternate_history_mod_apk.pdf
- https://cdn.sqhk.co/zupodejadofe/HQieibT/hello_dolly_bars_smitten_kitchen.pdf
- http://gofadivus.mygamesonline.org/empathic_listening.pdf
- https://pakujefaf.weebly.com/uploads/1/3/0/7/130740244/57f5fa5.pdf
- https://givebuzuwipagin.weebly.com/uploads/1/3/0/7/130775776/7929176.pdf
- https://sewogasi.weebly.com/uploads/1/3/1/1/131163712/zenukalufud.pdf
- https://cdn.sqhk.co/kekotenonaxu/Cowighg/flip_master_game_y8.pdf
- https://cdn.sqhk.co/lexaxemiji/jdhcBbS/vice_news_hbo_showtime.pdf
- https://duvafoxugijotad.weebly.com/uploads/1/3/5/3/135305538/2467963.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://www.msftconnecttest.com/connecttest.txt
Embedded domains
- xajibur.ru
- dunokosira.weebly.com
- vesedakowata.onlinewebshop.net
- cdn.sqhk.co
- rejorevubirobu.sportsontheweb.net
- gofadivus.mygamesonline.org
- pakujefaf.weebly.com
- givebuzuwipagin.weebly.com
- sewogasi.weebly.com
- duvafoxugijotad.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Embedded IP addresses
- 4.247.188.224
- 52.123.252.239
- 52.110.12.24
- 52.230.59.222
- 52.110.12.16
- 4.230.171.124
- 203.26.79.13
- 74.178.240.61
- 74.178.76.54
- 52.123.128.14
- 52.123.129.14
- 135.233.45.222
- 4.209.250.170
- 20.42.65.89
- 20.184.175.18
- 52.148.114.188
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report