MALICIOUS — fa1c0a3d42c1312afa3723a3ea9f52a0aaf14aacbc31069f9f32a7cd69388028
MALICIOUS — fa1c0a3d42c1312afa3723a3ea9f52a0aaf14aacbc31069f9f32a7cd69388028 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
fa1c0a3d42c1312afa3723a3ea9f52a0aaf14aacbc31069f9f32a7cd69388028 - SHA-1:
2789890e60af385931be6def81fd91fe3b93add4 - MD5:
0ba0977edfd5b15f413caed9465b9fd3 - ssdeep:
1536:9+PD6osvi84dx/e8wadYKHWtrLx6WypOlLJd7rm2WrasL0RQHI+imY2:nrxQBe8Fd1WLxLlLJtaIR72 - TLSH:
T19837CFF350D7DD9CB78A8B0369EB119A608ED74C2262EB1044C8BA6CD9FC97D7E04590 - Submitted as: fa1c0a3d42c1312afa3723a3ea9f52a0aaf14aacbc31069f9f32a7cd69388028
- File type: pdf · Size: 74768 bytes
- Verdict: malicious (98/100)
Detections (4 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 7 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: http://www.og2c.com/images/file/1047768405.pdf - network signal, weight 0.70, confidence 0.80
- Contacted 17 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://garglob.ru/uplcv?utm_term=brawl+stars+chaos+mod+apk, https://storage-in-motion.com/wp-content/plugins/formcraft/file-upload/server/content/files/161322e005117f---90005457099.pdf, http://kraemer-duennebacke.de/files/file/mizupuv.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
9659 behavior events · 0 ATT&CK techniques · 3 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- ntp.ubuntu.com
- 250.255.255.239.in-addr.arpa
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
Dropped files
- C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\1a3968ffa2dfd01e37b6b9dc3fc25014.png -
64403413dd784faa8831b6b6af5b689d18da46fbfcc0cb89497d8a260383e904 - C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt -
0571023c732496a5793e8357a62012e7c892882db5c0a293b027d9dd1c10cb90 - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://garglob.ru/uplcv?utm_term=brawl+stars+chaos+mod+apk
- https://storage-in-motion.com/wp-content/plugins/formcraft/file-upload/server/content/files/161322e005117f---90005457099.pdf
- http://kraemer-duennebacke.de/files/file/mizupuv.pdf
- https://amezdigital.com/wp-content/plugins/super-forms/uploads/php/files/e26feb18d54c2f9bf9bc26ee471ddc98/baremojebimijesusogoza.pdf
- https://satesayap.com/contents/files/44412620702.pdf
- http://www.og2c.com/images/file/1047768405.pdf
- https://multimetrics.com/ckfinder/userfiles/files/nanazigeviju.pdf
- http://eltdb.com/UserFiles/files/40235246631.pdf
- http://www.mananthavadynorbertines.org/www/js/ckfinder/userfiles/files/15848979914.pdf
- https://amezdigital.com/wp-content/plugins/super-forms/uploads/php/files/b524925ffd10d228bda20b1d476405a4/69383983572.pdf
- https://sidexsideaudio.com/wp-content/plugins/formcraft/file-upload/server/content/files/16130d4fe15da9---kudabulawobejuvuxedos.pdf
- http://ratchee.com/ckfinder/userfiles/files/pevutubusebin.pdf
- http://fertilityupdates.com/userfiles/files/makigufalo.pdf
- https://lokmangal.co.in/wp-content/plugins/super-forms/uploads/php/files/d5528a081139d8392c929698f4f68bc4/kukisekoxaxuduzo.pdf
- http://upservice.expert/admin/ckfinder/userfiles/files/xofulud.pdf
- https://amkboiler.com/wp-content/plugins/super-forms/uploads/php/files/j3f127l4kvu7hd33e8f9dig0qc/tusepakitekukoza.pdf
- https://vegas-shop.net/uploads/files/42689397270.pdf
- http://architettorobertafasola.eu/userfiles/files/jevukuzawusedef.pdf
- http://chizclean.ru/files/fck/file/febizilebaxebodox.pdf
- http://interreg-ipa-husrb.com/downloads/jusafugugir.pdf
- http://mistral-paints.cz/userfiles/files/ronokoladagoguwet.pdf
- http://bekkercoon.ru/ckfinder/userfiles/files/75660637759.pdf
- http://yuc-fac.com/uploadfiles/20210906094607.pdf
- https://www.artikel238.nl/emmwebbit/resources/ckfinder/userfiles/files/selamowapixef.pdf
- https://ochronaskory.pl/pliki_user/File/45686075725.pdf
Embedded domains
- garglob.ru
- storage-in-motion.com
- kraemer-duennebacke.de
- amezdigital.com
- satesayap.com
- www.og2c.com
- multimetrics.com
- eltdb.com
- www.mananthavadynorbertines.org
- sidexsideaudio.com
- ratchee.com
- fertilityupdates.com
- lokmangal.co.in
- amkboiler.com
- vegas-shop.net
- architettorobertafasola.eu
- chizclean.ru
- interreg-ipa-husrb.com
- bekkercoon.ru
- yuc-fac.com
- www.artikel238.nl
- ochronaskory.pl
- honghuibio.com
- www.physioaktivkramer.de
- www.w3.org
Embedded IP addresses
- 135.232.92.34
- 162.159.142.9
- 172.66.2.5
- 20.42.179.192
- 52.123.252.212
- 52.253.84.76
- 52.110.12.49
- 4.230.171.124
- 135.233.95.135
- 20.42.65.84
- 74.179.77.204
- 52.123.128.14
- 172.178.240.162
- 74.179.71.159
- 203.26.79.13
- 104.208.16.94
- 4.150.223.98
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report