MALICIOUS — jegiwi.pdf

MALICIOUS — jegiwi.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: f39ddc938140ed9ae27b7a62e3de062e011bb469bf8df0218c87a8a5c2ddf13c
SHA-1: 5e75560bacdd41198eca4ad4dcddd9867e2052f1
MD5: 6a9e73d259d52e222a8b19bbee1fcaab
ssdeep: 3072:fEKojCflN3auxqfSschxm4PmA77n6Y3m3:cKblN3zAasiQ4N7m
TLSH: T15E3AD0F36087DD9C6A47EF0765EB11ACA049E7983172DB40008CAB7CD57CABCAE14A41
Submitted as: jegiwi.pdf
File type: pdf · Size: 101549 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://peoplefoster.com/pliki/91392359472.pdf - network signal, weight 0.70, confidence 0.80
Contacted 24 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://imreelectric.sk/uploads/file/tunanijozonalodeg.pdf, https://citronel.com/userfiles/files/97403862470.pdf, http://peoplefoster.com/pliki/91392359472.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9707 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
desktop-hsgcbep
ntp.ubuntu.com
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\1c34e508c3b183b8647c3a36d7767ec4.png - df45d02e440adfab7313991fd428f28e0abfd9e389a9c7994a07f43bac8ec5e5
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 5e84b450b2b1ac9584c96f8f58fed1a38adb212f4c1b09372f8fb012acf0a031
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/skout/mBVl/~3/zMnd8XtcwSM/uplcv?utm_term=what+to+bring+to+employment+based+green+card+interview
http://imreelectric.sk/uploads/file/tunanijozonalodeg.pdf
https://citronel.com/userfiles/files/97403862470.pdf
http://peoplefoster.com/pliki/91392359472.pdf
https://www.colegiodesafio.net/home/wp-content/plugins/formcraft/file-upload/server/content/files/160740bb41f681---gidowonoxibigon.pdf
https://www.schroedersales.com/wp-content/plugins/super-forms/uploads/php/files/8caf75cd790f0197ab9cb907b808f1de/bimikemifima.pdf
http://jamoncup.es/wp-content/plugins/formcraft/file-upload/server/content/files/160c7195536371---soxamafotag.pdf
http://3suntech.com/UploadFile/file/20210613083626903.pdf
https://jennysbooks.com/wp-content/plugins/super-forms/uploads/php/files/287dbbb9fabb87ea78c8fa73bbe4790d/41170279815.pdf
http://alliusie.com/userfiles/file/zezen.pdf
http://moveisgarciadigital.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160aca4651b1ad---zibutan.pdf
http://studiovalecchi.it/userfiles/files/47512956633.pdf
http://clainvest.pl/userfiles/file/78350223770.pdf
http://www.integra-cr.cz/administrace/ckfinder/userfiles/files/gelosemijagut.pdf
http://haniltm.kr/upfiles/editor/files/mukejaterovadatidowila.pdf
http://perfectthesale.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b87d58bd962---kunakawuzed.pdf
http://chandigarhdatarecovery.com/files/file/jenurobajokom.pdf
http://sjar-tech.com/uploadfile/file///2021072916284746.pdf
https://247christianity.org/fckeditor/userfiles/file/139369793291626219914.pdf
https://www.blackandwhite-salon.com/wp-content/plugins/super-forms/uploads/php/files/8ac8200eb8c2cbcb9769d4edd1b2bb05/3373693787.pdf
https://www.booster-p.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c2837bbfa61---71933781999.pdf
https://nepalimodelagency.com/userfiles/file/14159771629.pdf
http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160dd942569244---86476448616.pdf
https://danielstrehlau.com/userfiles/file/30355049669.pdf
https://ckmusicdesign.nluserfiles/file/mokaparik.pdf

Embedded domains

feedproxy.google.com
citronel.com
peoplefoster.com
www.colegiodesafio.net
www.schroedersales.com
jamoncup.es
3suntech.com
jennysbooks.com
alliusie.com
moveisgarciadigital.com.br
studiovalecchi.it
clainvest.pl
haniltm.kr
perfectthesale.com
chandigarhdatarecovery.com
sjar-tech.com
247christianity.org
www.blackandwhite-salon.com
www.booster-p.com
nepalimodelagency.com
www.1000ena.com
danielstrehlau.com
bishopsalamatkhokhar.org
www.w3.org
purl.org

Embedded IP addresses

4.247.188.233
172.172.255.218
52.123.252.198
52.230.59.222
52.110.12.46
52.110.12.5
57.155.101.212
4.230.171.124
52.123.252.245
20.42.179.192
74.179.77.204
72.154.7.98
52.123.129.14
40.104.4.2
20.184.175.13
203.26.79.13
172.178.240.162
74.178.232.29
142.251.42.99
20.184.175.23
40.79.141.153
172.172.255.217
52.123.252.212
4.150.223.102

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report