MALICIOUS — f899315ac3e56e90779f92c15c279113c5204b88e90029bb4663eeac6eacafc7

MALICIOUS — f899315ac3e56e90779f92c15c279113c5204b88e90029bb4663eeac6eacafc7 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: f899315ac3e56e90779f92c15c279113c5204b88e90029bb4663eeac6eacafc7
SHA-1: a059a13526e0983e09fc7d2fa6a096273448d432
MD5: 80ff9fddf25b214acbcfab4e9716d70b
ssdeep: 1536:dnPA41HQeu+4Crtv1c+NHmyQefJ+AFGGQjWb1WkNpOPOPBF1fZWhwjUZ+rGkIgG:BAGwJ+4KtvVmNsIAog6POPNf4wjUsrps
TLSH: T13638D0B321A7CD9C369FDF035AEA1069D487E7D42122EB805188BB2C857C5BDBE20D50
Submitted as: f899315ac3e56e90779f92c15c279113c5204b88e90029bb4663eeac6eacafc7
File type: pdf · Size: 83308 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://ambulatorioveterinariocamali.com/userfiles/files/36464746307.pdf - network signal, weight 0.70, confidence 0.80
Contacted 22 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://chukguwang.com/files/fckeditor/file/34690544165.pdf, http://stapper.de/sites/default/files/userfilesfile/73094893249.pdf, http://idealhca.com/admin/images/file/nebaxivule.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9671 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
ntp.ubuntu.com
desktop-hsgcbep
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\dd475559d90fa72d765c10fdf4e317d0.png - bf2c277b24da68056f41fbd3c00303fb93cf9e087017659c70270a0bda4c60d8
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 8b9de23f269dd5262e926430ba1f5d7fa01792a79e469599514d11285e9372ab
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/A3Ryygt5BCM/uplcv?utm_term=how+to+download+as+pdf+on+mac
http://chukguwang.com/files/fckeditor/file/34690544165.pdf
http://stapper.de/sites/default/files/userfilesfile/73094893249.pdf
http://idealhca.com/admin/images/file/nebaxivule.pdf
https://ud-hobby.com/images/Upload/file/53335759241.pdf
http://servicedental.it/userfiles/files/pogejikigijimomoxa.pdf
http://ambulatorioveterinariocamali.com/userfiles/files/36464746307.pdf
http://www.physedu.in/newsite/userfiles/files/dovubut.pdf
https://nuregio.de/wp-content/plugins/formcraft/file-upload/server/content/files/1614356bfe80a6---tetuwivuluzuvofukaxewo.pdf
http://carrozzeriardue.it/userfiles/files/40504562813.pdf
https://pensionradvanice.cz/res/file/xafugutuxa.pdf
http://heryeryesil.com/resimlerfiles/31146440630.pdf
http://prestopc.it/upload/file/6660520987.pdf
http://wawa757.com/uploads/files/begovukukumelusalugorudo.pdf
http://monticellotownship.org/userfiles/file/renedafefuderug.pdf
http://zs.tom.ru/jsplugins/ckfinder/userfiles/files/begujifupubu.pdf
http://wienbildarchiv.com/upload_files/files/fulomazutevezuxegume.pdf
https://zaragozadenoche.es/upload/files/kiwekafojugelizowumupi.pdf
http://slxiang.com/v15/Upload/file/20219152154552243.pdf
https://duvanco.be/docs/files/zenovarojoda.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/

Embedded domains

feedproxy.google.com
chukguwang.com
stapper.de
idealhca.com
ud-hobby.com
servicedental.it
ambulatorioveterinariocamali.com
www.physedu.in
nuregio.de
carrozzeriardue.it
heryeryesil.com
prestopc.it
wawa757.com
monticellotownship.org
zs.tom.ru
wienbildarchiv.com
zaragozadenoche.es
slxiang.com
duvanco.be
www.w3.org
purl.org
ns.adobe.com
pensionradvanice.cz

Embedded IP addresses

20.42.73.27
72.145.35.105
52.123.252.215
52.110.12.52
20.247.185.124
4.230.171.124
85.210.193.152
20.165.94.54
135.232.92.137
40.104.4.2
52.123.129.14
135.233.45.223
72.145.35.100
203.26.79.13
20.42.65.88
52.123.252.245
92.223.78.30
40.84.97.4
20.42.179.192
20.184.175.12
20.42.65.91
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report