MALICIOUS — fe87d5e90e06a65f9bc02f695236e997d7f839bb6b01b62ff82c746fb0b47e32
MALICIOUS — fe87d5e90e06a65f9bc02f695236e997d7f839bb6b01b62ff82c746fb0b47e32 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
fe87d5e90e06a65f9bc02f695236e997d7f839bb6b01b62ff82c746fb0b47e32 - SHA-1:
33efe414ce8bd6502f28325aabe35a8e60913afe - MD5:
28a00d8030e792b13d4a2b2bfd57bf05 - ssdeep:
1536:djvtWLJ/OwslO4oPAnk49kpnp6MDmyzlzXKefqUnUlA:5MLJ/OlO4oPAk78at5XKefqUt - TLSH:
T13138D0E7A157DD4DB6879B43BDA72AAD308EC7C4313697941084B62CC1BCABE3D50901 - Submitted as: fe87d5e90e06a65f9bc02f695236e997d7f839bb6b01b62ff82c746fb0b47e32
- File type: pdf · Size: 78977 bytes
- Verdict: malicious (98/100)
Detections (5 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Trellix Stinger (McAfee): PDF/Phish-FAB!28A00D8030E7
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 7 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: https://uploads.strikinglycdn.com/files/34cd7bb9-af02-4b75-bbb9-2b1a0cb2d8b6/what_channel_is_bounce_on_xfinity_tv.pdf - network signal, weight 0.70, confidence 0.80
- Contacted 13 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://golowaki.ru/123?utm_term=african+christian+theology+pdf, https://fifitusaperofij.weebly.com/uploads/1/3/4/6/134605769/2412362.pdf, https://uploads.strikinglycdn.com/files/34cd7bb9-af02-4b75-bbb9-2b1a0cb2d8b6/what_channel_is_bounce_on_xfinity_tv.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Extracted generic config (10 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
9712 behavior events · 0 ATT&CK techniques · 3 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- _dosvc._tcp.local
- ntp.ubuntu.com
- desktop-hsgcbep
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Dropped files
- C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt -
d5c05a97d44e101b312e8b92cb5063fc02341c0b17feeb0e206df6ae391afd95 - C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\aaff9204266ef02b2957d6fa2ed27242.png -
61a94c013ea029308fee8e144d53ac03b5d671d0cff08d99070cff10f0e4475c - root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://golowaki.ru/123?utm_term=african+christian+theology+pdf
- https://fifitusaperofij.weebly.com/uploads/1/3/4/6/134605769/2412362.pdf
- https://uploads.strikinglycdn.com/files/34cd7bb9-af02-4b75-bbb9-2b1a0cb2d8b6/what_channel_is_bounce_on_xfinity_tv.pdf
- https://xizunobalik.weebly.com/uploads/1/3/0/7/130739811/pubunumono-nojuve.pdf
- https://dolilufaxeni.weebly.com/uploads/1/3/2/6/132683246/c452c0335d.pdf
- https://uploads.strikinglycdn.com/files/00e92fb9-38d6-41cb-a2c7-a6300aabf287/92234073641.pdf
- https://mixuvuweti.weebly.com/uploads/1/3/1/4/131483588/wixopuvalipo.pdf
- https://uploads.strikinglycdn.com/files/94a26dbe-8aa2-4429-b23d-d057cf9b1585/what_color_wallet_is_lucky_2020.pdf
- https://uploads.strikinglycdn.com/files/2c3a1759-f381-45e6-aea3-84b9ad82f65c/nivowozufojifuxeg.pdf
- https://kuxijixa.weebly.com/uploads/1/3/4/8/134856984/zibobanalaru_lifuruv_renokivetugozak.pdf
- https://zizojatemizowen.weebly.com/uploads/1/3/4/0/134016780/vorogefifalo.pdf
- https://uploads.strikinglycdn.com/files/0837d50e-e751-490c-9c3a-b79fae2c48e2/xiruroteronoruxalomivado.pdf
- https://uploads.strikinglycdn.com/files/ed775daa-fe6e-4d6b-a255-2edd0ac9a279/why_is_h2so4_a_stronger_acid_than_h3po4.pdf
- http://tagexoba.pbworks.com/f/90348003042.pdf
- https://vafumavuforowa.weebly.com/uploads/1/3/4/4/134489815/7000184.pdf
- https://jiresuzava.weebly.com/uploads/1/3/4/7/134706808/zugenegewupux.pdf
- https://putepinezuvoko.weebly.com/uploads/1/3/1/8/131856998/d15d271f59.pdf
- http://fatakalewene.pbworks.com/f/86494546803.pdf
- https://kenomixu.weebly.com/uploads/1/3/0/9/130969587/tapalo-levewedegame-vitutojirox-norizegidifuv.pdf
- https://uploads.strikinglycdn.com/files/74e03291-ed5b-4a81-b38d-f8e160d917b2/dopurikavofazajasivug.pdf
- https://uploads.strikinglycdn.com/files/1a8c1994-018d-4aef-b8ee-dcda52e9a76a/old_school_hip_hop_songs_clean.pdf
- https://mezemefi.weebly.com/uploads/1/3/1/3/131384279/6215211.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- golowaki.ru
- fifitusaperofij.weebly.com
- uploads.strikinglycdn.com
- xizunobalik.weebly.com
- dolilufaxeni.weebly.com
- mixuvuweti.weebly.com
- kuxijixa.weebly.com
- zizojatemizowen.weebly.com
- tagexoba.pbworks.com
- vafumavuforowa.weebly.com
- jiresuzava.weebly.com
- putepinezuvoko.weebly.com
- fatakalewene.pbworks.com
- kenomixu.weebly.com
- mezemefi.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Embedded IP addresses
- 20.42.65.89
- 57.154.63.210
- 4.230.171.124
- 74.178.240.51
- 74.178.240.61
- 52.123.129.14
- 72.145.35.108
- 203.26.79.13
- 52.123.252.247
- 52.123.252.240
- 20.184.175.17
- 48.192.143.121
- 52.148.114.188
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report