MALICIOUS — fa4d2d2eb17c55066c0edcb8555f59b36266063bb7d749267057d3eee0b5a0ee

MALICIOUS — fa4d2d2eb17c55066c0edcb8555f59b36266063bb7d749267057d3eee0b5a0ee is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: fa4d2d2eb17c55066c0edcb8555f59b36266063bb7d749267057d3eee0b5a0ee
SHA-1: aa8ac80d3914aad6c275d172035cd6eb937560c5
MD5: 895326d811c17992426503c4c98e871f
ssdeep: 1536:kMLKweghFFjn1VU2tWh8UlqDlFzMkAsJl1UobgXoOWcIn9vwpiQ2W8pO7Q9m:5n1V5Wh8UMDXzUsJl1UMw42piQV7B
TLSH: T10837C0FB609FDE8C76D75F0359E61568A082D7881172EB914084A67C987CABCBE20B50
Submitted as: fa4d2d2eb17c55066c0edcb8555f59b36266063bb7d749267057d3eee0b5a0ee
File type: pdf · Size: 72633 bytes
Verdict: malicious (95/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 95/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 16 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://catamma.ru/uplcv?utm_term=how+to+find+point+estimate+calculator, http://petukmahaaaraj.com/userfiles/file/22361636046.pdf, https://www.whoamiandwhyamihere.com/ckfinder/userfiles/files/walisuli.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9679 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787883673&P2=404&P3=2&P4=ikR7GUCZm%2fAk%2f4ow3NrPn8Oe71Rbj8Ut5XqRrmkzrsJqbwnmrMPHp2500BDHDvzIJljd561fMPqbuYF1Qw7V3Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\aca333d53e2d8382c28724e74cea1b16.png - bf5a92e509741be12e92efc0e5ca599dd53c79868d2bdc870030be665c67400c
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 63a92611dbe9d919ae5fb25f2f04df03431294cc708c50f8137c7b23f0a84beb
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://catamma.ru/uplcv?utm_term=how+to+find+point+estimate+calculator
http://petukmahaaaraj.com/userfiles/file/22361636046.pdf
https://www.whoamiandwhyamihere.com/ckfinder/userfiles/files/walisuli.pdf
http://weforyou.it/userfiles/files/xawozu.pdf
http://sage-chem.com/image/files/20210906_124412.pdf
https://polytex.de/sites/default/files/23793335443.pdf
http://tortsurprise.ru/upload/redactor/files/sodulifuvorukafa.pdf
https://2winit.com/Files/files/mojimonu.pdf
http://sinocelltech.com/filespath/files/20210913175921.pdf
https://www.syria-report.com/sites/all/libraries/ckfinder/userfiles/files/55394544413.pdf
https://riwg.in/userfiles/file/80219897113.pdf
https://rmissio.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16148ad175d470---kiluzozuvobupasesarefen.pdf
http://www.jindatunnel.com/up_files/file/88522940093.pdf
http://hungthanhauto.com/luutru/files/19244898073.pdf
http://rfinshaat.az/userfiles/file/bupiwegebarogezo.pdf
http://kioskcondoweb.wpengine.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614f9b99409ad---foserusisa.pdf
http://acetuitioncentre.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/161543739bfaf1---98821355681.pdf
http://www.siscard.com/wp-content/plugins/formcraft/file-upload/server/content/files/16139ac8469fa3---noxujebudupukitatukase.pdf
https://tadimtursu.com/image/files/83046205718.pdf
http://studioassociatoemc.com/userfiles/files/74089780881.pdf
http://moutierrozeille.fr/userfiles/file/55209542515.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/

Embedded domains

catamma.ru
petukmahaaaraj.com
www.whoamiandwhyamihere.com
weforyou.it
sage-chem.com
polytex.de
tortsurprise.ru
2winit.com
sinocelltech.com
www.syria-report.com
riwg.in
rmissio.pl
www.jindatunnel.com
hungthanhauto.com
kioskcondoweb.wpengine.com
acetuitioncentre.com.au
www.siscard.com
tadimtursu.com
studioassociatoemc.com
moutierrozeille.fr
www.w3.org
purl.org
ns.adobe.com
rfinshaat.az

Embedded IP addresses

74.178.232.29
52.110.12.20
52.110.12.45
4.144.132.114
4.230.171.124
20.42.179.192
20.165.94.54
74.179.77.204
20.236.44.162
52.123.128.14
40.103.64.242
203.26.79.13
52.123.252.213
135.232.92.34
4.150.223.103
4.150.223.109

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report