MALICIOUS — f0c56299c0d2c29a084d7b7e1a5af7e69dd1e3ff15258dea7708bcabefaa4bf2

MALICIOUS — f0c56299c0d2c29a084d7b7e1a5af7e69dd1e3ff15258dea7708bcabefaa4bf2 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: f0c56299c0d2c29a084d7b7e1a5af7e69dd1e3ff15258dea7708bcabefaa4bf2
SHA-1: 6a6cbb29a65ba3eec4a9f99fc4b62c893b554c93
MD5: 9c1a547752e3b32afc66f63476c7dd5f
ssdeep: 1536:zIeYonfDUo1cllVeoHc4E7ktqDfqiKiUCIeuH2fWCQ6ccJW6pOu2V5+pM4AEd:6gDUrlTDEYtgSzDCi2pvzqu2VMtJ
TLSH: T10039C0F311EBDD9C7B8B8B4369B60178A086D78C22229FA05188777CC47C5FE6B90600
Submitted as: f0c56299c0d2c29a084d7b7e1a5af7e69dd1e3ff15258dea7708bcabefaa4bf2
File type: pdf · Size: 84402 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://normec-cm.com/ckfinder/userfiles/files/5249278085.pdf - network signal, weight 0.70, confidence 0.80
Contacted 21 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://normec-cm.com/ckfinder/userfiles/files/5249278085.pdf, http://ana-jsc.com/upload/files/94491005071.pdf, http://eamenfaraz.com/cache/fck_files/file/bizunisizunawumenotikef.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9711 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep._dosvc._tcp.local
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787915153&P2=404&P3=2&P4=alPluuYxWdWC%2f47f5sn7srg6FGDc2pMnNB8pnUY1uMT8tOj0VHqRsooUUNxX9cGdOYoRlk3Lt9qyhYbb1AihSA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787915214&P2=404&P3=2&P4=IWuFntQJxLHV4urgt9llEPP%2b7%2fXOzQ%2bqDhbGWrlSCpPxSjxuH%2fBeO%2bVdvX4gg1JTLm6aXER%2faRHXDG3RDjmeRA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 020ca006d698150ec26c95d96bcbd487d3e25387d1f9c5b12b9177f1bdfda6f4
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\addd30a524be830413b64ed9d0352957.png - 9490040197e85cebbefca0fc860d694898b359edd6ea25544dd3f5a47cd4140d
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/3CAf4wW3hvY/uplcv?utm_term=electrical+engineering+books+pdf+free+download+sites
https://normec-cm.com/ckfinder/userfiles/files/5249278085.pdf
http://ana-jsc.com/upload/files/94491005071.pdf
http://eamenfaraz.com/cache/fck_files/file/bizunisizunawumenotikef.pdf
http://vladekoservis.ru/files/88889215595.pdf
http://circuitvietnamcambodge.com/hinhanh/file/90058742857.pdf
https://fgcrubochi.com.ng/ckfinder/userfiles/files/50656507023.pdf
http://jinwoosmc.com/userfiles/file/92711175681.pdf
http://centrlita.ru/archive/image/file/87698480612.pdf
https://swimproject.eu/wp-content/plugins/super-forms/uploads/php/files/cdb990efddb80a4360dd2e8146d15f14/28256721947.pdf
http://gardena.crazyrockinsushi.com/uploads/files/xizebezi.pdf
http://safetyassessmentsolutions.co.uk/ckfinder/userfiles/files/ruwedefatejob.pdf
https://www.sblending.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/16134cb3cad1fe---7382390250.pdf
https://biodent.ro/m4fm_files/m4news/ck-uploads-files/9416800627.pdf
https://alkoplast.rs/files/74744220620.pdf
https://vildmarksjagt.dk/userfiles/file/rojoxupepu.pdf
https://bangprice.com/bangprice.com/beta/cms_image/file/wixepo.pdf
http://ahjygjg.com/upload_fck/file/2021-9-4/20210904023050919586.pdf
http://gardatrans.com/content/Files/19191788487.pdf
https://12shio2.com/contents/files/wumowimanefidode.pdf
https://cradlegold.com/wp-content/plugins/super-forms/uploads/php/files/ir2mncojh3549bm9esmactub9h/39060703666.pdf
http://hanauhrova.cz/files/nijusufikiwotowoxawabafe.pdf
https://speculatio.in/userfiles/file/wozufur.pdf
https://soyana.de/js/ckfinder/userfiles/files/85386524039.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

feedproxy.google.com
normec-cm.com
ana-jsc.com
eamenfaraz.com
vladekoservis.ru
circuitvietnamcambodge.com
jinwoosmc.com
centrlita.ru
swimproject.eu
gardena.crazyrockinsushi.com
safetyassessmentsolutions.co.uk
www.sblending.com.au
bangprice.com
ahjygjg.com
gardatrans.com
12shio2.com
cradlegold.com
speculatio.in
soyana.de
www.w3.org
purl.org
ns.adobe.com
fgcrubochi.com.ng
biodent.ro
alkoplast.rs

Embedded IP addresses

20.42.73.31
172.215.188.225
51.105.71.137
74.179.71.159
52.110.12.47
4.230.171.124
72.153.5.63
203.26.79.13
20.247.184.197
20.165.94.63
74.178.76.54
20.231.239.246
52.123.129.14
40.99.133.226
52.123.252.192
135.233.45.221
52.168.117.175
20.42.73.26
48.199.12.1
20.42.65.88
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report