MALICIOUS — f67e1fa559ab60203ab5c4a42a420c04efa4c1b0d061f08196de66920e4de31b

MALICIOUS — f67e1fa559ab60203ab5c4a42a420c04efa4c1b0d061f08196de66920e4de31b is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: f67e1fa559ab60203ab5c4a42a420c04efa4c1b0d061f08196de66920e4de31b
SHA-1: 8fdd0e4a1d67d38130e315f1907da701d7418875
MD5: 48f6be53600df6b7ae9bc9c1052566ab
ssdeep: 1536:XKExjn2SdooBt1PfGCdrONq9VNDdqBi36FeQ3WncHbhjt3WUpO7YU0d:6WzthPeCg89VhdqBiSbMc7hjtq7I
TLSH: T14F37D0F321E7DD8C378A5F0379FA129AA48AD78C6771EA8005887A6C847C57DBF10950
Submitted as: f67e1fa559ab60203ab5c4a42a420c04efa4c1b0d061f08196de66920e4de31b
File type: pdf · Size: 70644 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Contacted 16 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: https://heatingboiler.ca/fck_upload/file/vokataxe.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://huntic.ru/uplcv?utm_term=after+we+collided+watch+online+for+free, https://niboparis.com/upload/fckeditor/files/paxamorigelarisubudine.pdf, https://amezdigital.com/wp-content/plugins/super-forms/uploads/php/files/e5a50b28b41608604a12c00850c10629/72191590556.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9625 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787933772&P2=404&P3=2&P4=KNMRTVc05uJP4E%2bjrkEjIf6WrK%2b6YAF0tWEFu6sEDK47bSFWnkOeo2K7VAWUVRGTdB16e2IDhx%2fjwpfWzCwR0Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787933801&P2=404&P3=2&P4=Z7d5AyWov%2f9Ys6mSbbmxMypPJw7MPy%2fjJY%2fZnlY9nmv%2fp9yPhvdTM19aak6PUOFHgEeJd266SAq0Y3f40PaNlA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 456a96d7460e4b412faadd5304e2f97859c2303f5b1834199d02175aeea50bcd
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\033d924a928178d8ccf2ca3862131473.png - 6fac2af8da3eeb78a40917f47cb065104822d612db28c2e751a13dab38a771db
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://huntic.ru/uplcv?utm_term=after+we+collided+watch+online+for+free
https://niboparis.com/upload/fckeditor/files/paxamorigelarisubudine.pdf
https://amezdigital.com/wp-content/plugins/super-forms/uploads/php/files/e5a50b28b41608604a12c00850c10629/72191590556.pdf
https://heatingboiler.ca/fck_upload/file/vokataxe.pdf
https://bnovum.hu/downloads/87562578917.pdf
http://hanasushichoice.com/uploads/files/91209145246.pdf
https://processwork.archerhuang.com/ConImg/files/katarebojizeroseti.pdf
http://wabasnb.com/files/fckeditor/file/17750469816147cc425ca00.pdf
http://synerfreight.com/syner_upload/images/files/35516134286.pdf
http://abwingsmd.com/uploads/files/paxazo.pdf
http://ephtour.com/FileData/ckfinder/files/20210920_71AEB9AF64D0E512.pdf
https://deltaguvenlik.net/userfiles/file/fulelazugawujamok.pdf
http://avandcie-energy.com/ckfinder/userfiles/files/wugopurodaxota.pdf
https://ltes.tw-goods.com/UserFiles/files/90953809577.pdf
http://bjoybrands.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612ec49458c18---niguzizexalisenewopa.pdf
https://appvid.eus/userfiles/files/dedozowobirinunowusu.pdf
http://zssadkowice.pl/pliki/zorodawo.pdf
http://www.adanakursmerkezi.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614c66f25c1f5---23383815440.pdf
https://confidence-ist.com/ckfinder/userfiles/files/bakowo.pdf
https://tsegypt.com/file/gugetikebesanuga.pdf
http://lesmashclub.com/imgUpload/files/73124755942.pdf
http://szilasfood.hu/pic_upload/files/59857883528.pdf
https://www.channeloflove.com/ckfinder/userfiles/files/45299141608.pdf
https://homestayhoian.vn/uploads/image/files/givazulobozowuxitil.pdf
http://arcomproltd.com/userfiles/file/544899671.pdf

Embedded domains

huntic.ru
niboparis.com
amezdigital.com
heatingboiler.ca
hanasushichoice.com
processwork.archerhuang.com
wabasnb.com
synerfreight.com
abwingsmd.com
ephtour.com
deltaguvenlik.net
avandcie-energy.com
ltes.tw-goods.com
bjoybrands.com
zssadkowice.pl
www.adanakursmerkezi.com
confidence-ist.com
tsegypt.com
lesmashclub.com
www.channeloflove.com
arcomproltd.com
www.w3.org
purl.org
ns.adobe.com
bnovum.hu

Embedded IP addresses

52.110.12.31
52.110.12.45
4.230.171.124
52.253.84.76
74.179.77.204
74.178.240.51
52.123.129.14
72.145.35.106
203.26.79.13
4.150.223.113
52.123.252.244
52.123.252.226
92.223.78.30
74.178.76.128
172.170.180.133
20.42.73.30

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report