MALICIOUS — fa4a1ad34f567eade650ca4838ac5f4bec4a114601032e673b54f89ab399b54b

MALICIOUS — fa4a1ad34f567eade650ca4838ac5f4bec4a114601032e673b54f89ab399b54b is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: fa4a1ad34f567eade650ca4838ac5f4bec4a114601032e673b54f89ab399b54b
SHA-1: 8e2a372c459e5c4fc96f67336d6081e17650e564
MD5: f2883c9dc2351c991616792ff3a89f2c
ssdeep: 1536:9bHTz/YS7dhNBKrY7gj+jVYSUhuKrXU7rd6kSWesrz4NWspO2M1c:FHTz/Y8hnR0SjVYSUhuKr6Yk0srck2X
TLSH: T1A339D0F322EBDE5C754BDB0B69BA5128704BE7C81172DA804188BB2CD57C5BDBE40620
Submitted as: fa4a1ad34f567eade650ca4838ac5f4bec4a114601032e673b54f89ab399b54b
File type: pdf · Size: 86317 bytes
Verdict: malicious (98/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: http://www.globalnautique.nl/upload/files/kuvojezor.pdf - network signal, weight 0.70, confidence 0.80
Contacted 24 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://www.ccps.mx/wp-content/plugins/super-forms/uploads/php/files/b8956a9c785a9af811e770f14928b390/60759190187.pdf, https://benhgout.net/uploads/Files/file/molax.pdf, https://anglarill.net/userfiles/file/93365370398.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9684 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787890844&P2=404&P3=2&P4=AH8s2kqgGLTzM37J%2bolH7A0CG0xyNJCbv68qDQLQNu9%2b5ZXws%2bBP%2fV0TtnnIUmc7FocOdQwaASgEbxWpH9ANVg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787890913&P2=404&P3=2&P4=E0C%2bLOLHJ%2fLjcO88cdUGJWiTPCyPw2URl6GG3OSCokI%2bdM6kLZUn6APjs%2b%2bpQ8wORYkboxgFWF%2fEEv6N9IIfNg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\a6932b1f7eb92d60cdc2bd1b3b2d9d18.png - 18dc10a2088f4f5787ccf3883017e1d3b9ed4e0e137f93828fa27f2cdf551b89
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 5c51301402573db52b9287bc1284cbcecc3ad8108f509bc7656d090d58449d72
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/skout/mBVl/~3/3CAf4wW3hvY/uplcv?utm_term=grob%27s+basic+electronics+11th+edition+solutions+pdf
https://www.ccps.mx/wp-content/plugins/super-forms/uploads/php/files/b8956a9c785a9af811e770f14928b390/60759190187.pdf
https://benhgout.net/uploads/Files/file/molax.pdf
https://anglarill.net/userfiles/file/93365370398.pdf
http://bitree.net/ckfinder/userfiles/files/bebasovemivuniv.pdf
http://pphjako.pl/userfiles/file/57927857079.pdf
https://encoyun.com/calisma2/files/uploads/jajewenavodid.pdf
https://altaitur.com/ckfinder/userfiles/files/liburefotavisafi.pdf
http://modellszerviz.hu/userfiles/file/22373556956.pdf
http://www.globalnautique.nl/upload/files/kuvojezor.pdf
http://cuacuonanbinh.com/userfiles/file/munukaxubew.pdf
http://snkpost.com/fckedit_file/file///20210919_9_56_25.pdf
https://weilmclainboiler.ca/fck_upload/file/17202026892.pdf
http://burelomdo.com/ckfinder/userfiles/files/rofagumajuvofemet.pdf
https://www.davinci.dk/wp-content/plugins/formcraft/file-upload/server/content/files/1613059c1c20b5---nanituvigewusone.pdf
http://elitaliaweb.it/upload/file/75213826061.pdf
http://mnwebdesign.dk/userfiles/file/jujakumom.pdf
http://baanpowertrain.com/wp-content/plugins/formcraft/file-upload/server/content/files/161371a57179c3---nakizur.pdf
http://learnazia.com/fck/imagesfile/gevikedavewosizi.pdf
https://web-sila.ru/wp-content/plugins/super-forms/uploads/php/files/cc36e7ccaaac0eb3e577fb3ed63505c5/nepilanodedasupamesomika.pdf
https://madeinstlucia.com/userfiles/files/6898627232.pdf
https://fonixkoncert.hu/upload/file/28039158392.pdf
http://dtyxbpzx.com/filespath/files/20210916015833.pdf
https://www.grandiosa.is/wp-content/plugins/super-forms/uploads/php/files/f8mr9fgd5e9uv1kq07tjfjq037/2409735485.pdf
https://valenciamaids.com/userfiles/files/pemuwovagefuw.pdf

Embedded domains

feedproxy.google.com
www.ccps.mx
benhgout.net
anglarill.net
bitree.net
pphjako.pl
encoyun.com
altaitur.com
www.globalnautique.nl
cuacuonanbinh.com
snkpost.com
weilmclainboiler.ca
burelomdo.com
elitaliaweb.it
baanpowertrain.com
learnazia.com
web-sila.ru
madeinstlucia.com
dtyxbpzx.com
valenciamaids.com
www.w3.org
purl.org
ns.adobe.com
modellszerviz.hu
www.davinci.dk

Embedded IP addresses

20.184.175.11
52.168.112.66
4.150.223.106
52.123.252.230
52.110.12.15
4.230.171.124
72.154.7.102
203.26.79.13
20.247.185.124
172.66.2.5
52.123.252.234
52.123.252.244
20.112.250.133
74.178.240.61
52.123.129.14
40.99.133.242
40.99.134.2
135.233.45.222
20.184.175.17
135.233.95.80
57.155.104.224
48.192.143.121
20.184.175.7
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report