MALICIOUS — ef169116ed085a0b927fd343b33f4b91099cc7744dae992edf3de1641b655bb3
MALICIOUS — ef169116ed085a0b927fd343b33f4b91099cc7744dae992edf3de1641b655bb3 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
ef169116ed085a0b927fd343b33f4b91099cc7744dae992edf3de1641b655bb3 - SHA-1:
85a8ee9b974440993124dc49d71889c19ab24765 - MD5:
651f8ca96bb57e6fdeab820ad08fb867 - ssdeep:
1536:h9JUq9adeV7Jj3Jh5SIuqNEYwMYA/X5f8CZk:PqHe9RoIuqhwMHf+ - TLSH:
T13935D0F722979E0CFB8B8F526EEBA56D98CDD30541A2E6A081044774F1BC9BE3814901 - Submitted as: ef169116ed085a0b927fd343b33f4b91099cc7744dae992edf3de1641b655bb3
- File type: pdf · Size: 59984 bytes
- Verdict: malicious (98/100)
Detections (4 of 54 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Microsoft Defender: Trojan:PDF/Phish.HAG!MTB
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 9 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:PDF/Phish.HAG!MTB (rule
Trojan:PDF/Phish.HAG!MTB) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule
HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://philabc.ru/uplcv?utm_term=pirates+of+the+caribbean+4+full+movie+in+hindi+download+720p+khatrimaza, https://sibirprokat.ru/ckfinder/userfiles/files/58864139144.pdf, https://jmbarrenetxea.soinuenea.eus/files/galeria/files/sezufujofufevobaregisi.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Contacted 6 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
1060 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ntp.ubuntu.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- 23.40.52.209
- 23.11.37.157
- 20.190.167.19
- 20.247.185.124 SG · Singapore · AS8075 Microsoft Corporation
- 52.123.252.204 AU · Sydney · AS8075 Microsoft Corporation
- 23.33.238.178
- 52.110.12.20 AU · Sydney · AS8075 Microsoft Corporation
- 4.230.171.124 KR · Seoul · AS8075 Microsoft Corporation
- 23.33.238.173
- 192.168.122.110
- 2.18.226.150
- 2.18.226.39
Dropped files
- root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://philabc.ru/uplcv?utm_term=pirates+of+the+caribbean+4+full+movie+in+hindi+download+720p+khatrimaza
- https://sibirprokat.ru/ckfinder/userfiles/files/58864139144.pdf
- https://jmbarrenetxea.soinuenea.eus/files/galeria/files/sezufujofufevobaregisi.pdf
- https://agrocare.ro/ckfinder/userfiles/files/jopumebagukixijoxuj.pdf
- https://gimenezricarte-deltabogados.com/ckfinder/userfiles/files/47540643586.pdf
- http://musicfriend.vn/public/default/ckeditor/files/36983145176.pdf
- http://studiopetrilli.it/userfiles/files/72059742877.pdf
- http://datacomsystems.cz/userfiles/file/bekarolafofe.pdf
- https://controlcert.se/wp-content/plugins/formcraft/file-upload/server/content/files/1616a6b555cf0a---wesivam.pdf
- https://garraldaarquitectura.com/garralda_userfiles/files/85347419015.pdf
- https://bmw-zona.ru/uploads/file/peweniduzedojemu.pdf
- https://bengalroys.com/ckfinder/userfiles/files/gabisetelimubudemibedi.pdf
- https://yourtuscanyguide.com/wp-content/plugins/super-forms/uploads/php/files/68pk8035ifd53t0ti5p0bqlqd6/45682884247.pdf
- https://acrgroup.nl/userfiles/file/72120140700.pdf
- https://toliveinchristjesus.ceosale.catholic.edu.au/application/third_party/ckfinder/userfiles/files/90239595631.pdf
- http://ngocminhcnc.com/demo_thietbimay_24_7/upload/files/55291700158.pdf
- http://www.portofmiamitunnel.com/system/js/back/ckfinder/userfiles/files/82454838964.pdf
- http://emilybarnes.com/DEVELOPMENT/VERSIONED/emilybarnes/trunk/sites/default/files/file/92248560499.pdf
- http://china-shengbang.com/upload_fck/file/2021-10-1/20211001210820406220.pdf
- https://cvsc.co/userfiles/file/41050024315.pdf
- http://getampedmag.com/ckfinder/userfiles/files/34062020904.pdf
- http://makaifruits.com/wp-content/plugins/formcraft/file-upload/server/content/files/16148a83c54d9d---zomapo.pdf
- http://saopauloairporttransfers.com/ckfinder/userfiles/files/50989797998.pdf
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
Embedded domains
- philabc.ru
- sibirprokat.ru
- gimenezricarte-deltabogados.com
- studiopetrilli.it
- controlcert.se
- garraldaarquitectura.com
- bmw-zona.ru
- bengalroys.com
- yourtuscanyguide.com
- acrgroup.nl
- toliveinchristjesus.ceosale.catholic.edu.au
- ngocminhcnc.com
- www.portofmiamitunnel.com
- emilybarnes.com
- china-shengbang.com
- cvsc.co
- getampedmag.com
- makaifruits.com
- saopauloairporttransfers.com
- jmbarrenetxea.soinuenea.eus
- agrocare.ro
- musicfriend.vn
- datacomsystems.cz
Embedded IP addresses
- 20.42.179.192
- 57.155.104.224
- 20.247.185.124
- 52.123.252.204
- 52.110.12.20
- 4.230.171.124
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report