MALICIOUS — zeliguxanexiwamasuxep.pdf

MALICIOUS — zeliguxanexiwamasuxep.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100). 5 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: fc83d4a122e4da6d1d7da251f9942929e7f8b17222bf2ab9049755900ecb6788
SHA-1: bb0aa0ac87ba6b80307320b61332b4fb345bd196
MD5: e3bc11b2b2616a1c51cc462ab0d531c5
ssdeep: 1536:iQTkNwWcOVBuierMrQTzjUc6tV/Tnsn3sOFImXo/ostalx1CE5VZjex:bWcOvVerMrQTzjUt5LscObY/T0LRrZg
TLSH: T11038D0F31247FC5CEA9BAF4369D6106C648FD68861B3DA600894BB6CD96C5FE3E24500
Submitted as: zeliguxanexiwamasuxep.pdf
File type: pdf · Size: 78156 bytes
Verdict: malicious (97/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!E3BC11B2B261
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 97/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. RWX/private injected region in SumatraPDF.exe (pid 8940) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Contacted 17 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://principessavencanice.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c2410890af1---remagijupike.pdf, http://omonetach.pl/foto/ilustracje/file/xafalu.pdf, http://mfcwestenkwartier.nl/beta/userfiles/file/wifataxokodivegijiradivu.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9801 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
ntp.ubuntu.com
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 21a4afe96415910baa902f1bcd7a1f7cb644482f8ee0b131ab4ea6f7392daaa3
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\6f578d1e0be3834ce698e9568420bad0.png - 08d190ad711b595ab4dac408e4e2a32549e834e15a849bfd618bdefb0da67480
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/FevRqgeaUVY/uplcv?utm_term=sex+gta+sa
http://principessavencanice.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c2410890af1---remagijupike.pdf
http://omonetach.pl/foto/ilustracje/file/xafalu.pdf
http://mfcwestenkwartier.nl/beta/userfiles/file/wifataxokodivegijiradivu.pdf
http://kaies.cn/upfiles/file/94161592110.pdf
http://gostium.com/wp-content/plugins/formcraft/file-upload/server/content/files/160702d821700e---zonerawelixukogazavori.pdf
http://stardentalcare.org/userfiles/file/34619827497.pdf
https://iescolumbus.org/wp-content/plugins/super-forms/uploads/php/files/dc898504d0958a28ed312ad5b6abce78/21540794666.pdf
https://www.pietri-automobiles.com/wp-content/plugins/super-forms/uploads/php/files/64etj25mrocq0a9hq07osdr8vc/lexizebexo.pdf
https://razdolle.by/wp-content/plugins/super-forms/uploads/php/files/9s7qlft0bkuhrc6q715lml39q4/befexut.pdf
https://littlelightnepal.org/userfiles/file/basuw.pdf
https://www.costaverde.it/wp-content/plugins/formcraft/file-upload/server/content/files/1607e90e39a533---tiworikibubufavikafemejuz.pdf
https://abeess.com/userfiles/file/puzogudida.pdf
http://alphaconsultinggroup.us/vpw/images/file/jekasuzumufalepopejof.pdf
http://www.fattyweng.com.sg/wp-content/plugins/formcraft/file-upload/server/content/files/160c1bc691fba8---veritavurenetivazovi.pdf
http://janyska.home.pl/_mjanyska2013/fotki/file/pidoravoneze.pdf
http://tms-operation.com/upload/files/rapewibaxi.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Embedded domains

feedproxy.google.com
principessavencanice.com
omonetach.pl
mfcwestenkwartier.nl
kaies.cn
gostium.com
stardentalcare.org
iescolumbus.org
www.pietri-automobiles.com
littlelightnepal.org
www.costaverde.it
abeess.com
alphaconsultinggroup.us
www.fattyweng.com.sg
janyska.home.pl
tms-operation.com
www.w3.org
purl.org
ns.adobe.com
razdolle.by

Embedded IP addresses

172.215.188.232
74.178.240.61
52.110.12.28
48.211.4.16
4.230.171.124
20.247.184.142
20.89.1.13
20.165.94.54
52.123.128.14
20.184.175.10
52.123.252.192
72.154.7.108
203.26.79.13
52.168.117.174
74.178.76.44
142.251.42.99
74.178.232.29

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report