MALICIOUS — f38fa1ca5c8568437dc0029c77780bbbf08b501a6adc0979b4e0b3364cd35688

MALICIOUS — f38fa1ca5c8568437dc0029c77780bbbf08b501a6adc0979b4e0b3364cd35688 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: f38fa1ca5c8568437dc0029c77780bbbf08b501a6adc0979b4e0b3364cd35688
SHA-1: 4276124b170c3a015f7bfd2923968918ba4c23a4
MD5: 9295932abd874cb55770214511d51d01
ssdeep: 1536:YY1f/zno8AimmY71UjLnVZbEbcv4RjRWCpOViIWXMyMFZfZ:hBDGimmYZQVZbEbe42ViMyMFL
TLSH: T19737D0F320ABCC9CB7974B076DA7159CA04AD38C1661EE605088BBBC817C9BCFE14951
Submitted as: f38fa1ca5c8568437dc0029c77780bbbf08b501a6adc0979b4e0b3364cd35688
File type: pdf · Size: 72374 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://sportsbettingconsultants.net/cote_dor_import/admin/ckfinder/userfiles/files/86142104263.pdf - network signal, weight 0.70, confidence 0.80
Contacted 20 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://huntic.ru/uplcv?utm_term=octal+equivalent+of+the+decimal+number+567+is, http://gz-chengeng.com/uploadfile/files/kobixerasopo.pdf, http://sportsbettingconsultants.net/cote_dor_import/admin/ckfinder/userfiles/files/86142104263.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9556 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
desktop-hsgcbep
desktop-hsgcbep._dosvc._tcp.local
ntp.ubuntu.com
_dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 4888b5ba12b5576d2d5845e6f9b54383243d41ac85088708c50778c0c4b808e8
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\f4cbd95856b1212c76726b4f553e5322.png - 97e112898d942dc5f4f69bd23cc7eea31c7690f9c5ae70de6e0710f5bf249f76
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://huntic.ru/uplcv?utm_term=octal+equivalent+of+the+decimal+number+567+is
http://gz-chengeng.com/uploadfile/files/kobixerasopo.pdf
http://sportsbettingconsultants.net/cote_dor_import/admin/ckfinder/userfiles/files/86142104263.pdf
http://www.kymenhome-etsinta.net/tiedostot/files/34516911815.pdf
http://fgosvo.ru/files/files/5361178714.pdf
http://sangtaoad.com/uploads/userfiles/file/tuliniw.pdf
http://itkaufmann.com/images/fckimages/file/muxegawanuzoziwejepigi.pdf
http://speaklifeiamgreatness.com/files/files/tokiwil.pdf
http://ijfbn.com/editor_up/nanuxetazopelewijebutebu.pdf
http://www.gainerwindows.ca/wp-content/plugins/super-forms/uploads/php/files/b96j4a9dulr6b7olfudjgffbe6/xarekonepusijimaxiwujep.pdf
http://4bx.pl/public/file/96284864096.pdf
https://towa-aaa.jp/userfiles/file/meniwebazi.pdf
http://schouteninterieurwerk.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16160af7c4c65e---xosagin.pdf
http://3handseg.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614060ad5d70d---voxomoziguxisej.pdf
http://villaturri.com/wp-content/plugins/formcraft/file-upload/server/content/files/1615afcffca2e9---nogodi.pdf
http://sts-logistika.ru/wp-content/plugins/super-forms/uploads/php/files/e67eb505374366d5b0ec4eb0a6fc2848/nukafutekakufuxi.pdf
https://osakaav.com/userfiles/files/fefikofeta.pdf
http://pathtojanna.com/userfiles/files/13885535794.pdf
http://hoilhpnqbthanh.com/upload/file/83585440993.pdf
http://www.gainerwindows.ca/wp-content/plugins/super-forms/uploads/php/files/0cgujgamhgsk3krl9ep1rsfn71/51605272204.pdf
http://hotelpenza58.ru/ckfinder/userfiles/files/89363281474.pdf
http://www.studiolegalefusimorelli.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613032db452b6---66194624553.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/

Embedded domains

huntic.ru
gz-chengeng.com
sportsbettingconsultants.net
www.kymenhome-etsinta.net
fgosvo.ru
sangtaoad.com
itkaufmann.com
speaklifeiamgreatness.com
ijfbn.com
www.gainerwindows.ca
4bx.pl
towa-aaa.jp
schouteninterieurwerk.nl
3handseg.com
villaturri.com
sts-logistika.ru
osakaav.com
pathtojanna.com
hoilhpnqbthanh.com
hotelpenza58.ru
www.studiolegalefusimorelli.com
www.w3.org
purl.org
ns.adobe.com

Embedded IP addresses

40.79.141.153
74.178.240.61
85.210.193.152
52.123.252.222
172.66.2.5
40.84.85.40
4.230.171.124
52.123.252.224
52.253.84.76
72.154.7.105
203.26.79.13
74.179.77.204
4.150.223.106
52.123.252.218
52.123.128.14
40.99.134.18
135.233.95.80
48.199.12.1
4.150.223.112
52.148.114.188

File paths

j:\;

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report