MALICIOUS — eee1db4f1fcb5e909f7827b8a42ee8f71e067214916864b921b954edf9c368b7

MALICIOUS — eee1db4f1fcb5e909f7827b8a42ee8f71e067214916864b921b954edf9c368b7 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100). 4 of 54 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: eee1db4f1fcb5e909f7827b8a42ee8f71e067214916864b921b954edf9c368b7
SHA-1: f80e518ac9f19ec7fc4c122d1daf96e94e637127
MD5: 076bcf17ad5038f57aa6ce605e0b3f22
ssdeep: 1536:XGRGPtKK5kWBNSMbfPikCmUKNnnsMhdSe9FocZW21Fv3EW8pO7LAPntf:7PtpFBHVRnng+FocXv3X765
TLSH: T1E338C0F311D7DC4C778B8F4369EB51A9A489E3882171EB8040C8BB6CC5BC5BEBA14951
Submitted as: eee1db4f1fcb5e909f7827b8a42ee8f71e067214916864b921b954edf9c368b7
File type: pdf · Size: 83748 bytes
Verdict: malicious (100/100)

Detections (4 of 54 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://yuqiaohome.com/uploads/files/202109100222239046.pdf - network signal, weight 0.70, confidence 0.80
Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 16 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://yuqiaohome.com/uploads/files/202109100222239046.pdf, https://dfkcnc.shopper-store.net/file/files/duxudenodububesara.pdf, https://siangyun.com/upfiles/editor/files/lexoguzesiba.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

991 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
c.pki.goog
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
23.40.52.85

Dropped files

root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

http://feedproxy.google.com/~r/Xvkpad/~3/HTGXzuRVGb4/uplcv?utm_term=perran+sands+holiday+park
http://yuqiaohome.com/uploads/files/202109100222239046.pdf
https://dfkcnc.shopper-store.net/file/files/duxudenodububesara.pdf
https://siangyun.com/upfiles/editor/files/lexoguzesiba.pdf
http://turchifiltri.com/userfiles/files/pisifawubibesolotega.pdf
http://mamnonsaokhue.vn/app/webroot/files/ckfinder/files/jolavarazemupoposurika.pdf
http://andreevmag.com/wp-content/plugins/super-forms/uploads/php/files/b6a070152548d5a9352271a0a9f1016d/dilojomupebefujazikepel.pdf
https://www.cylinder96.ru/admin/ckfinder/userfiles/files/sabazugusinej.pdf
http://studiolauramoschini.it/userfiles/files/37920928776.pdf
http://vakantie-noordlimburg.nl/ckfinder/userfiles/files/56695859494.pdf
http://kazenergy.kz/wp-content/plugins/formcraft/file-upload/server/content/files/161420cff547ea---zaputubi.pdf
http://www.c-l-r-p.com/admin/ckfinder/userfiles/files/45751816169.pdf
http://sgd42.ru/userfiles/file/14810274388.pdf
https://www.euroservicemilano.it/wp-content/plugins/formcraft/file-upload/server/content/files/16137307312045---demadim.pdf
http://faw-asia.com/image/upload/files/95447480311.pdf
http://cmtl.in/uploads/userfiles/file/file/bulipazasejevimevupuz.pdf
https://adikkeempat.com/contents/files/misetotovevedupudubikopi.pdf
http://viacaosaopedro.com/www/js/ckfinder/userfiles/files/bulegajuwisodosoxo.pdf
http://consulcongress.it/uploads/assets/file/jaguzunixiwexufap.pdf
https://phucatgarment.com.vn/ckfinder/userfiles/files/luterugetotopudofex.pdf
https://vilnius.cvzona.lt/resources/img/files/47885799131.pdf
http://caerulumpharma.com/upload/files/jemukenafiporu.pdf
http://everbeenmagnet.com/js/upfiles/files/45776709118.pdf
http://kirche-treuen.de/UserFiles/File/39666408987.pdf
https://99shayari.in/userfiles/files/94085741053.pdf

Embedded domains

feedproxy.google.com
yuqiaohome.com
dfkcnc.shopper-store.net
siangyun.com
turchifiltri.com
andreevmag.com
www.cylinder96.ru
studiolauramoschini.it
vakantie-noordlimburg.nl
www.c-l-r-p.com
sgd42.ru
www.euroservicemilano.it
faw-asia.com
cmtl.in
adikkeempat.com
viacaosaopedro.com
consulcongress.it
caerulumpharma.com
everbeenmagnet.com
kirche-treuen.de
99shayari.in
ayhancevik.com
maxbrio.kr
www.w3.org
purl.org

Embedded IP addresses

40.84.97.4
20.42.179.192
85.210.196.11
34.54.88.138
72.145.35.97
57.154.63.210
72.153.5.130
52.110.12.25
52.110.12.47
4.230.171.124
172.215.188.232
172.215.188.225
135.233.95.144
20.184.175.18
51.105.71.137
52.123.252.194

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report