MALICIOUS — f313cd1ccce73dbd7dcaae752f7c322c6a8483518a80eeaf403af70ad1c7d1bf

MALICIOUS — f313cd1ccce73dbd7dcaae752f7c322c6a8483518a80eeaf403af70ad1c7d1bf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: f313cd1ccce73dbd7dcaae752f7c322c6a8483518a80eeaf403af70ad1c7d1bf
SHA-1: d16559861ca170fb53a34bf0ad871e1e993d190c
MD5: 6377fb568789dc5b9d532915aec50fbb
ssdeep: 1536:zLjUIAswj4eCpxFrmVCbk0VoASlOWi7mmxRdUWOpOwr6zExLmPu:zZAJJsx/H3SIFRdxwr6zEUm
TLSH: T1AB37CFE3629BDD4CB79B8F03A9BA01FC648AD6881232EB915488736CD4BC57D7E00951
Submitted as: f313cd1ccce73dbd7dcaae752f7c322c6a8483518a80eeaf403af70ad1c7d1bf
File type: pdf · Size: 70996 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://psycare-spb.com/userfiles/file/45403183241.pdf - network signal, weight 0.70, confidence 0.80
Contacted 22 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://garglob.ru/uplcv?utm_term=can+must+exercises+pdf, https://forkidsvietnam.vn/wp-content/plugins/super-forms/uploads/php/files/366a43gks24p7qo95fpprgbjk5/23424669062.pdf, https://gmt.twwebmarket.com/ckfinder/userfiles/files/99496537495.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9625 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 8c6b03310c29d2d943740f1bbfe3e5b4988ee413868028c9bb0c68c21e02deb7
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\b273d53e40a490dc1cc55b7da19b2385.png - 43ebed767d3f1151fad0ba46117aab95547d6a4c8130dc44cb4b92ee3d3f9737
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://garglob.ru/uplcv?utm_term=can+must+exercises+pdf
https://forkidsvietnam.vn/wp-content/plugins/super-forms/uploads/php/files/366a43gks24p7qo95fpprgbjk5/23424669062.pdf
https://gmt.twwebmarket.com/ckfinder/userfiles/files/99496537495.pdf
http://quartierdete.fr/uploads/fckeditor/file/nenakije.pdf
http://psycare-spb.com/userfiles/file/45403183241.pdf
http://ovecollection.com/royal/admin/images/products/file/19723332820.pdf
http://www.blueoak.fr/image/file/wavefowimamuwulovasexer.pdf
http://chrisdepanneservices.com/Sites/cds/files/befevefivej.pdf
http://alvitraders.com/files/25882743895.pdf
http://gemaeldeundobjekte.de/uploads/files/41865896109.pdf
https://monamifrance.com/FileData/ckfinder/files/20210914_0B1895B6EA42CDFC.pdf
http://jyotiacademicpress.org/uploads/file/82106754105.pdf
http://problemconsulting.com/img/download/files/83754285739.pdf
http://myepres.com/HotelEstimator/userfiles/file/kefununefitebu.pdf
http://geodez.com/pliki/file/33835153823.pdf
http://ei-windykacja.pl/upload/file/mibividujojas.pdf
http://somkuthyoptika.hu/editor_up/junalum.pdf
http://xn--z92bzy85x.com/userData/board/file/59305425344.pdf
http://rigosarchitects.gr/userfiles/file/mepanoxaxatizogotuxotes.pdf
https://molecult.metallo-tests.ch/sites/web/upload/files/57426548546.pdf
https://happycolaborativo.com/uploads/files/13011399775.pdf
https://nezamirekhaseafoods.com/userfiles/file/76415066042.pdf
http://hyundaidongdo3s.com/images/files/33086631102.pdf
https://takiminsahada.com/wp-content/plugins/super-forms/uploads/php/files/mrdrjocfhjns6mdn2lbhq9bc6u/sasozenegaputodanidiw.pdf
http://hilimall.ae/uploads/files/gefibenepiwe.pdf

Embedded domains

garglob.ru
gmt.twwebmarket.com
quartierdete.fr
psycare-spb.com
ovecollection.com
www.blueoak.fr
chrisdepanneservices.com
alvitraders.com
gemaeldeundobjekte.de
monamifrance.com
jyotiacademicpress.org
problemconsulting.com
myepres.com
geodez.com
ei-windykacja.pl
xn--z92bzy85x.com
molecult.metallo-tests.ch
happycolaborativo.com
nezamirekhaseafoods.com
hyundaidongdo3s.com
takiminsahada.com
www.w3.org
purl.org
ns.adobe.com
forkidsvietnam.vn

Embedded IP addresses

20.42.179.192
20.184.175.23
85.210.193.152
172.66.2.5
52.168.117.174
57.155.104.224
4.230.171.124
4.144.132.114
74.178.76.128
20.184.175.12
20.76.201.171
40.99.134.2
52.123.128.14
72.153.5.96
203.26.79.13
20.165.94.46
92.223.78.30
40.79.141.153
4.150.223.109
172.170.180.133
4.150.223.100
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report