MALICIOUS — f830e935fbaacd76573eb23ab9fb5b2507ed4a8bcd586eca50c37cd9fc086de4

MALICIOUS — f830e935fbaacd76573eb23ab9fb5b2507ed4a8bcd586eca50c37cd9fc086de4 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: f830e935fbaacd76573eb23ab9fb5b2507ed4a8bcd586eca50c37cd9fc086de4
SHA-1: 5f965bb7dd84ee7683097f28b4942a3f0337ba17
MD5: 683de15394aa5eb2e87e2b5d3435adb3
ssdeep: 1536:KWJI6us0Lh3W0YpS8rqORbk07TQyyQb7/OANWQdkwaWypOlWWxlbfxGp6U+L82a5:FisY+qORUyFb7/nWQdplDlopt88p
TLSH: T1BF39D0F331D7DC4C3A6ACF5365FA5168B58ADA886133EE504048B96CD97C67E2F002A1
Submitted as: f830e935fbaacd76573eb23ab9fb5b2507ed4a8bcd586eca50c37cd9fc086de4
File type: pdf · Size: 89277 bytes
Verdict: malicious (96/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Contacted 24 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://kammed.com/userfiles/file/92134486441.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: http://mlead.net/images/e/file/30167703099.pdf, http://chipgene.com/image/files/20210927_125803.pdf, http://bckvalumni.org/userfiles/file/60570081408.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9727 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
ntp.ubuntu.com
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
desktop-hsgcbep
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - c2b95fc910d3f4e9722976857aa20394d129dd61c7e06faa0b868e792b440b95
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\394d302caf49c8a3c7561acc0df10b3d.png - 93e2b07056faf1034f2de1ec5627a77a55ccac074e523fa3d2b37baac5ba9381
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Gsjc/~3/2I9n2o-U8HI/uplcv?utm_term=little+baby+crying+sound
http://mlead.net/images/e/file/30167703099.pdf
http://chipgene.com/image/files/20210927_125803.pdf
http://bckvalumni.org/userfiles/file/60570081408.pdf
https://www.zaantraining.nl/wp-content/plugins/formcraft/file-upload/server/content/files/161698117d8dd2---digujolojo.pdf
http://www.de.ruben.pl/ckfinder/userfiles/files/pagitojiwefezukejamot.pdf
http://www.ciesol.es/ckfinder/userfiles/files/devodeve.pdf
https://segurodegranizo.ar/noticias/fckeditor/file/vopesoresolita.pdf
http://pegasomeeting.medcoast.net/ckfinder/userfiles/files/nisenomokitoraf.pdf
https://korvioinfotech.com/ckfinder/userfiles/files/63750955771.pdf
http://kammed.com/userfiles/file/92134486441.pdf
http://hawaiisushi.iorderfoods.com/uploads/files/vivujidexip.pdf
http://www.sunarmisir.com.tr/wp-content/plugins/super-forms/uploads/php/files/su182e1kj6mgs01c95capgks35/93504436067.pdf
http://sushiloverca.com/uploads/files/62978185873.pdf
https://ganganagardentist.com/userfiles/file/40115332190.pdf
http://indianmailbox.com/assets/images/userfiles/files/55165123607.pdf
https://www.aledrukujemy.pl/ckfinder/userfiles/files/85724946040.pdf
https://www.multilandtours.com/assets/ckfinder/userfiles/files/tajak.pdf
http://fundacjaproartis.pl/javascript/ckfinder/userfiles/files/fupaliru.pdf
https://www.ferienhof-schneider.de/wp-content/plugins/formcraft/file-upload/server/content/files/16137e2fd28d48---71241990766.pdf
https://www.tratedu.net/ssss2018/assets/143ad273/ckfinder/core/connector/php/upload/userfiles/files/ef79aa6977cd48a8a57aa2f2bbf873e1.pdf
http://erfanekeshmiri.ir/userfiles/file/26246143022.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/

Embedded domains

feedproxy.google.com
mlead.net
chipgene.com
bckvalumni.org
www.zaantraining.nl
www.de.ruben.pl
www.ciesol.es
pegasomeeting.medcoast.net
korvioinfotech.com
kammed.com
hawaiisushi.iorderfoods.com
sushiloverca.com
ganganagardentist.com
indianmailbox.com
www.aledrukujemy.pl
www.multilandtours.com
fundacjaproartis.pl
www.ferienhof-schneider.de
www.tratedu.net
erfanekeshmiri.ir
www.w3.org
purl.org
ns.adobe.com
segurodegranizo.ar
www.sunarmisir.com.tr

Embedded IP addresses

52.168.117.168
20.184.175.5
4.150.223.115
4.150.223.111
162.159.142.9
48.211.4.16
52.168.112.66
4.149.227.78
52.110.12.53
52.110.12.45
4.230.171.124
74.179.77.164
74.178.240.61
20.76.201.171
52.123.129.14
40.99.134.18
40.99.133.242
52.123.252.213
20.165.94.63
74.178.76.44
203.26.79.13
142.250.195.131
92.223.78.30
52.168.117.170

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report