MALICIOUS — f25fbd905e0a4d2eb8fc5e7cfeaae7d7d5266f0201e5a8fbc872a681d4f0c2e1

MALICIOUS — f25fbd905e0a4d2eb8fc5e7cfeaae7d7d5266f0201e5a8fbc872a681d4f0c2e1 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: f25fbd905e0a4d2eb8fc5e7cfeaae7d7d5266f0201e5a8fbc872a681d4f0c2e1
SHA-1: 33446168e996935d42be69addd3d4c3570de50eb
MD5: 181be17b75f8c7eaca35e4225c8b2f60
ssdeep: 1536:IKJtYy/vgY5lVpau4SmnggYB5H8Y4Xd1gnhXKOWKSn3w8PD:bflVpGOB5H8H3ghKOk3we
TLSH: T12E37DFF36197EE8C7EC35393B9A6115C7449C289B53396A044C4AB6CC8747FEAF20861
Submitted as: f25fbd905e0a4d2eb8fc5e7cfeaae7d7d5266f0201e5a8fbc872a681d4f0c2e1
File type: pdf · Size: 76222 bytes
Verdict: malicious (96/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!181BE17B75F8
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Contacted 18 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://englandmatchshirts.com/assets/file/1783762448.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: http://www.klpreschool.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609c31e58d285---zuxifibugetogekun.pdf, https://www.hamburgeriaagricola.com/wp-content/plugins/super-forms/uploads/php/files/ahi26p1lskfll49c1u4qgi9gs3/wogadejijegobabavegalivo.pdf, http://triumphtoday.org/wp-content/plugins/formcraft/file-upload/server/content/files/1606fdf83d6b89---bozitiwutudusi.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9687 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\e57567fb4cb5427a5859728dc24e54b0.png - 45b97a45c5dd7b05309dee8a205a4e7e3c22429430bdc286591d87c42146e09c
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 73dfeafc33c4b40397f65e060d27a117982889726003bd9866a464a6432df8ca
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/1xuhb7AK25c/uplcv?utm_term=font+sans+serif+css
http://www.klpreschool.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609c31e58d285---zuxifibugetogekun.pdf
https://www.hamburgeriaagricola.com/wp-content/plugins/super-forms/uploads/php/files/ahi26p1lskfll49c1u4qgi9gs3/wogadejijegobabavegalivo.pdf
http://triumphtoday.org/wp-content/plugins/formcraft/file-upload/server/content/files/1606fdf83d6b89---bozitiwutudusi.pdf
https://boyanbolyarski.com/userfiles/file/31679262680.pdf
http://cleannshieldflorida.com/wp-content/plugins/super-forms/uploads/php/files/4d3ec182ba996b78f48652cf21ecf71b/fogigedexevewolijo.pdf
http://www.findvoters.com/userfiles/file/76501435718.pdf
http://ajtoablakcentrum.com/_user/file/35107882055.pdf
http://englandmatchshirts.com/assets/file/1783762448.pdf
https://www.beewellrx.com/wp-content/plugins/super-forms/uploads/php/files/tmp/nowizugaropomaduwoban.pdf
http://vilaportugal.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083f1ea710fc---8459729833.pdf
http://www.neslihanonur.com/wp-content/plugins/super-forms/uploads/php/files/d2a20ae906cd4575b03632a66cfd4bf2/xupenanofo.pdf
http://heizler.hu/files/file/negizomixapubapasorek.pdf
http://heritagecarletonplace.com/clients/c/c2/c23aa4fb54f25340752d20cfcff880b2/File/38583019124.pdf
http://www.xpresswedding.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a1d800309bc---rotupolitagubotek.pdf
http://www.kidnuri.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ce34e18714c---55529812722.pdf
http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160abf60ae15aa---tosopupeve.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Embedded domains

feedproxy.google.com
www.klpreschool.com
www.hamburgeriaagricola.com
triumphtoday.org
boyanbolyarski.com
cleannshieldflorida.com
www.findvoters.com
ajtoablakcentrum.com
englandmatchshirts.com
www.beewellrx.com
vilaportugal.com
www.neslihanonur.com
heritagecarletonplace.com
www.xpresswedding.com
www.kidnuri.com
www.1000ena.com
www.w3.org
purl.org
ns.adobe.com
heizler.hu

Embedded IP addresses

85.210.196.11
40.79.141.154
52.123.252.215
4.247.188.224
52.110.12.25
52.110.12.21
4.230.171.124
52.230.59.222
51.132.193.104
135.233.95.144
74.178.76.128
40.99.133.226
52.123.129.14
74.178.232.29
203.26.79.13
51.105.71.137
48.192.143.121
20.42.65.84

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report