MALICIOUS — f087eb083074033b9c5f815c3611b5f200400977bce3486920d05b6adda95780

MALICIOUS — f087eb083074033b9c5f815c3611b5f200400977bce3486920d05b6adda95780 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: f087eb083074033b9c5f815c3611b5f200400977bce3486920d05b6adda95780
SHA-1: 9d2ccc1e3c5c81688f5f22ad74da856206b09981
MD5: c19011c7cebcec805462cbb2ce2e21c9
ssdeep: 1536:lo8P8piwvkwW1cviT7Xuut2p6D1IocDhGavLzMfR/dGKcFWOpOwrI79Z9WbUqIzd:2u8pBOKviT76p6D1IocDhGaXMfPcCwrg
TLSH: T1E439D0F711E3DD4C76CF5B03BEA621B4905ADB8862A2AF5041C87A6CC17C5BCAE10952
Submitted as: f087eb083074033b9c5f815c3611b5f200400977bce3486920d05b6adda95780
File type: pdf · Size: 86415 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 22 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://infotechloyalty.com/bot/ckfinder/uf/files/10257289043.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://infotechloyalty.com/bot/ckfinder/uf/files/10257289043.pdf, http://www.masozilina.sk/ckfinder/userfiles/files/76587394769.pdf, https://ijmscr.com/ckfinder/userfiles/files/84284873887.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9747 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\d9b7c3c7c4b7aedf73f683c58c5dcb6c.png - 6661b3bf1321079c61b9edcf0eb52de6f898a0323fa7ffbab666abaee2da57de
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - f304e7e9514427689e7eb258321b421d1a37fd54f8bf1e6199b568ba7122b5a0
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/Om9ozkHLxGw/uplcv?utm_term=what+do+you+need+to+make+a+name+tag+in+minecraft
https://infotechloyalty.com/bot/ckfinder/uf/files/10257289043.pdf
http://www.masozilina.sk/ckfinder/userfiles/files/76587394769.pdf
https://ijmscr.com/ckfinder/userfiles/files/84284873887.pdf
http://xn--nellieskche-0hb.de/userfiles/file/suzasaporugobama.pdf
http://goteneplast.se/files/images/file/sitezen.pdf
https://rowsontw.com/shopadmin/upload/files/gazet.pdf
http://abwingssuffolk1.com/uploads/files/43787613505.pdf
http://alt-1c.ru/userfiles/file/samilivafotukodasebukopu.pdf
https://www.autopsrus.com/ckfinder/userfiles/files/37379802600.pdf
http://divorce-difficile.fr/userfiles/file/kudumovuditepaso.pdf
http://inspirationallabels.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/16130a0d909e6d---kisivigoxipo.pdf
http://newo.ru/files/files/mojenisagetowusirugoge.pdf
https://spa-salon.ru/ckfinder/userfiles/files/27864014978.pdf
https://vanphongphampmc.com/upload/files/73682638901.pdf
http://klasykarozrywki.pl/public/images/fck/file/pisulozetiwerizux.pdf
http://lnianemarzenie.pl/userfiles/file/23710687076.pdf
http://mosjob.ru/images/file/ririkupagodalizovo.pdf
https://ecoinkworld.com/wp-content/plugins/super-forms/uploads/php/files/b721c6bc82353f51992bd2799370e503/xegejupudeniwakaxifofu.pdf
http://heaig.org/editor/ckfinder/userfiles/files/towenitosozo.pdf
http://hasanmasat.com/ckfinder/userfiles/files/gegegewamuruperetewiki.pdf
http://anchor-m.com/js/upload/files/nigodutipetemejemesa.pdf
http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614203e637569---wiruwuxizanasugod.pdf
http://nceed.kr/pds/userfiles/files/20211360876.pdf
http://lsneotek.com/ckupload/files/58770910720.pdf

Embedded domains

feedproxy.google.com
infotechloyalty.com
ijmscr.com
xn--nellieskche-0hb.de
goteneplast.se
rowsontw.com
abwingssuffolk1.com
alt-1c.ru
www.autopsrus.com
divorce-difficile.fr
inspirationallabels.co.uk
newo.ru
spa-salon.ru
vanphongphampmc.com
klasykarozrywki.pl
lnianemarzenie.pl
mosjob.ru
ecoinkworld.com
heaig.org
hasanmasat.com
anchor-m.com
www.1000ena.com
nceed.kr
lsneotek.com
conservationenergy.com

Embedded IP addresses

74.178.76.128
172.215.188.232
125.56.205.17
20.247.184.142
4.230.171.124
52.110.12.37
125.56.205.34
52.110.12.46
57.154.63.210
203.26.79.13
135.232.92.137
40.79.167.9
40.99.133.226
52.123.128.14
52.123.252.243
104.46.162.229
20.165.94.46
172.178.240.161
48.200.63.27
20.184.175.19
13.89.179.12
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report