MALICIOUS — fd459b583cdf9ef5409355da52006a0ae0384547f88b2bbc9a6a1c9ff63d9c06

MALICIOUS — fd459b583cdf9ef5409355da52006a0ae0384547f88b2bbc9a6a1c9ff63d9c06 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: fd459b583cdf9ef5409355da52006a0ae0384547f88b2bbc9a6a1c9ff63d9c06
SHA-1: 7a81fff95905db5ec54f59f654581055103f47f6
MD5: 11c8cc11c477ec66ec1b1c52e5172941
ssdeep: 1536:afAK8wg8+0BEvFDwK4hyBGpJkgctiLvMiN2/X/Zwieh7LbnmUZWbpONiWSDYPBlQ:lBY+/NwK4ppJkbtiLvMiowi67LDvbNcP
TLSH: T1E939C0F322EBDD5C769BCB036AEB10696086D7842172DE900485776CC17C5BEBE04E52
Submitted as: fd459b583cdf9ef5409355da52006a0ae0384547f88b2bbc9a6a1c9ff63d9c06
File type: pdf · Size: 90286 bytes
Verdict: malicious (95/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 95/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 18 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://baigeleather.com/userfiles/file/lurozeketozebadetuwefisag.pdf, http://kpotplace.com/uploads/files/radufagawetet.pdf, http://vinacafe-dalat.com/Images_upload/files/49184895650.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9728 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
250.255.255.239.in-addr.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\e42e7756c72e8dfb12dd2a6c56d98464.png - ca2d1663662e7a3ce06a2ca95eff6296fea3eece1c5eb3c65016edaa37029769
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 3f378298ced102afce594dceb37c91c6ca6e96ce370bb9e927ec01e7c55b4f84
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/Gsjc/~3/EqozwcbAC44/uplcv?utm_term=how+to+get+landorus+therian+forme+pokemon+go
http://baigeleather.com/userfiles/file/lurozeketozebadetuwefisag.pdf
http://kpotplace.com/uploads/files/radufagawetet.pdf
http://vinacafe-dalat.com/Images_upload/files/49184895650.pdf
http://aaaa.handyfriendship.com/upload/files/zolepexupobamokuponimome.pdf
http://auburn-properties.com/userfiles/files/nebigabuzamitug.pdf
http://www.deewanalarab.com/up_imgs/najatososunobo.pdf
http://architectureanddesign.it/userfiles/files/95515089258.pdf
http://diagonal.org.ar/wp-content/plugins/formcraft/file-upload/server/content/files/161490fcb4db81---depiwatirezubavegijap.pdf
https://hiddencliff.kr/FileData/ckfinder/files/20210927_DDDF62BFDBF5A5DC.pdf
http://droprint.my/home/ququ4923/public_html/userfiles/file/pududolosanudagepoleta.pdf
http://maroba-zirndorf.de/file/wupafudukenu.pdf
https://dom4m.de/userfiles/files/jaferabolazof.pdf
http://youandisagenix.com/ckfinder/userfiles/files/vazilijomitapiwapuketav.pdf
http://tornyanggrace.com/upload/file/76814158539.pdf
https://hkfew.org.hk/ckfinder/userfiles/files/buwiguniganiderexogo.pdf
https://brillimet.com/uploads/files/202109282247467718.pdf
http://www.auditsi.com/wp-content/plugins/formcraft/file-upload/server/content/files/16140f67bef755---97427112688.pdf
https://inclinedigital.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614bb4e2400c8---xotizibepewegifalabiziw.pdf
https://alwillislifecenter.org/ckfinder/userfiles/files/25819785856.pdf
http://quimis.org/js/ckfinder/userfiles/files/3847678443.pdf
https://www.geosuiteonline.de/wp-content/plugins/formcraft/file-upload/server/content/files/1614bd158aca95---zuvirarelonar.pdf
http://koreabulk.net/userData/board/file/rujipufafopejukupenisaxi.pdf
http://scsytech.com/upload/files/dubisofemege.pdf
http://boletos.luzservicos.com/ckfinder/userfiles/files/8695302719.pdf

Embedded domains

feedproxy.google.com
baigeleather.com
kpotplace.com
vinacafe-dalat.com
aaaa.handyfriendship.com
auburn-properties.com
www.deewanalarab.com
architectureanddesign.it
hiddencliff.kr
maroba-zirndorf.de
dom4m.de
youandisagenix.com
tornyanggrace.com
hkfew.org.hk
brillimet.com
www.auditsi.com
inclinedigital.com
alwillislifecenter.org
quimis.org
www.geosuiteonline.de
koreabulk.net
scsytech.com
boletos.luzservicos.com
for-rent-antwerp.com
dpengineerindia.com

Embedded IP addresses

4.144.132.114
52.110.12.55
4.230.171.124
4.247.188.224
51.132.193.105
20.112.250.133
74.178.76.128
52.123.128.14
40.104.4.2
172.178.240.163
172.215.188.225
203.26.79.13
52.123.252.225
4.150.223.107
52.123.252.242
92.223.78.30
172.178.240.161
13.89.179.12

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report