MALICIOUS — f126e30069d42ec3de1ac52df8779d170609beed259de0f1dfa575aa2b42b41b

MALICIOUS — f126e30069d42ec3de1ac52df8779d170609beed259de0f1dfa575aa2b42b41b is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: f126e30069d42ec3de1ac52df8779d170609beed259de0f1dfa575aa2b42b41b
SHA-1: 6ecc0e3ffeda8d7f8edd513bc6fae7bdf03d0ab4
MD5: 5ee499da37051d13ff45e807232391b2
ssdeep: 1536:pogp8VP/KFfbnzMHmy9DleriwbiTqWH+IeLu7TosWR54/+5pfEp9UW8pO7MyTpS7:FffbzMHT9MyMIgOUiG3fEp9n7U
TLSH: T19B37D0F361DBDCDC76465F4399AA012CA54BD7946132EA90008CB96CD87C9FCBF10A61
Submitted as: f126e30069d42ec3de1ac52df8779d170609beed259de0f1dfa575aa2b42b41b
File type: pdf · Size: 74080 bytes
Verdict: malicious (99/100)

Detections (4 of 54 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 9 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://makaeximworld.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609aa7946da26---3783741597.pdf, http://www.sunaryem.com.tr/wp-content/plugins/super-forms/uploads/php/files/rmop7jn08i3pueveo5rfchklm0/vekuwakebiviveku.pdf, http://cityhighclassof77.com/clients/9/9e/9ea685038b5a197d2022a69b8c6b162a/File/12606957979.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

1031 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
c.pki.goog
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
desktop-hsgcbep._dosvc._tcp.local
desktop-hsgcbep(1)._dosvc._tcp.local
desktop-hsgcbep(2)._dosvc._tcp.local
desktop-hsgcbep(3)._dosvc._tcp.local
desktop-hsgcbep(4)._dosvc._tcp.local
desktop-hsgcbep(5)._dosvc._tcp.local
desktop-hsgcbep(6)._dosvc._tcp.local
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl

Dropped files

root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/YTWXjIUwRh0/uplcv?utm_term=jeepers+creepers+2+movie+download+in+hindi+480p
http://makaeximworld.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609aa7946da26---3783741597.pdf
http://www.sunaryem.com.tr/wp-content/plugins/super-forms/uploads/php/files/rmop7jn08i3pueveo5rfchklm0/vekuwakebiviveku.pdf
http://cityhighclassof77.com/clients/9/9e/9ea685038b5a197d2022a69b8c6b162a/File/12606957979.pdf
http://anhbanglaw.com/userfiles/file/turenifikuvada.pdf
http://smartvoicecom.com/userfiles/putasitazunazudesazig.pdf
http://chayka-svg.ru/files/21024259793.pdf
https://mytopics.it/uploads/file/58418883789.pdf
https://www.hdcorp.com.br/wp-content/plugins/super-forms/uploads/php/files/p8gmm4sqtmht4kqhmpsg9s6dc7/mujubulufobujubal.pdf
http://school19-zav.ru/userfiles/file/nixebigovuxajuriluvenebu.pdf
http://sugarfree-gelato.com/upload/file/26747443132.pdf
https://fastcomputer.vn/wp-content/plugins/super-forms/uploads/php/files/d6004867e1d55c43b0d3695de92e4b5e/75828861539.pdf
https://levin-dent.ru/wp-content/plugins/super-forms/uploads/php/files/5b4f77a7d17da25b0cb7152ed524ffbe/gojutozalodizaxugi.pdf
http://ahcxdq.com/uploads/file/122300288033.pdf
http://thermogroup.ru/uploads/files/letuveb.pdf
http://neoneofitou.com/ckfinder/userfiles/files/mafixebajanotewunitinu.pdf
http://indiebookoftheday.com/wp-content/plugins/formcraft/file-upload/server/content/files/160aae9ca19d9e---49077435600.pdf
https://speakingparrot.com/upload/ckfinder/files/65035259491.pdf
https://trellisdundee.com/wp-content/plugins/super-forms/uploads/php/files/0cc986fbf37c558a146aae94b13367dc/35935076158.pdf
http://dom-nenilovo.ru/wp-content/plugins/super-forms/uploads/php/files/703961b3cb51b586ccbe51781294eaeb/roterokudufubulores.pdf
https://scavilecis.it/userfiles/file/nubigovejujudor.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/

Embedded domains

feedproxy.google.com
makaeximworld.com
cityhighclassof77.com
anhbanglaw.com
smartvoicecom.com
chayka-svg.ru
mytopics.it
www.hdcorp.com.br
school19-zav.ru
sugarfree-gelato.com
levin-dent.ru
ahcxdq.com
thermogroup.ru
neoneofitou.com
indiebookoftheday.com
speakingparrot.com
trellisdundee.com
dom-nenilovo.ru
scavilecis.it
www.w3.org
purl.org
ns.adobe.com
www.sunaryem.com.tr
fastcomputer.vn
x2.c.lencr.org

Embedded IP addresses

57.155.101.212
74.178.240.61
52.110.12.1
52.110.12.31
4.230.171.124
4.144.132.114
52.168.117.175
135.233.95.144
20.184.175.14

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report