MALICIOUS — 4818079_city__navigator__russia_.pdf

MALICIOUS — 4818079_city__navigator__russia_.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 087d572dd95795b0a56b33ed2ac07e62e4353bc049b464797f354304f704b463
• SHA-1: 7393f4e91505a2a031e4c3fa7092dd34c41d95a4
• MD5: 661a96e6ebf35ea3a0a2566c923bec2c
• ssdeep: 12288:8/dpTlYMmgGDJJIGI/RtwPOTgZa1g63m0LR:0FJgzBySDZa1giLR
• TLSH: T1FC4912F69A06DD09C99876EA3D29043FB902911620F03B317867A9F773772B7170D21A
• Submitted as: 4818079_city__navigator__russia_.pdf
• File type: pdf · Size: 400364 bytes
• Verdict: malicious (97/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Dropper.Agent-7480778-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.13

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 97/100 is the fusion of 6 weighted signals:

• ClamAV (daily) flagged Pdf.Dropper.Agent-7480778-0 (rule Pdf.Dropper.Agent-7480778-0) - engine signal, weight 0.90, confidence 0.95
• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.13 (rule PDF.Spam.Heur.13) - engine signal, weight 0.55, confidence 0.85
• Embedded link rated suspicious by URL analysis: http://img1.liveinternet.ru/images/attach/c/7//4817/4817465_skachat__muzuyku__90h_.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: http://botcraftman.ru/?lip&keyword=city+navigator+russia+201510+navicom+%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+%D1%82%D0%BE%D1%80%D1%80%D0%B5%D0%BD%D1%82&charset=utf-8, http://img1.liveinternet.ru/images/attach/c/7//4817/4817465_skachat__muzuyku__90h_.pdf, http://img1.liveinternet.ru/images/attach/c/7//4817/4817807_mister__kredo__luchshee_.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://botcraftman.ru/?lip&keyword=city+navigator+russia+201510+navicom+%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+%D1%82%D0%BE%D1%80%D1%80%D0%B5%D0%BD%D1%82&charset=utf-8
• http://img1.liveinternet.ru/images/attach/c/7//4817/4817465_skachat__muzuyku__90h_.pdf
• http://img1.liveinternet.ru/images/attach/c/7//4817/4817807_mister__kredo__luchshee_.pdf
• http://img1.liveinternet.ru/images/attach/c/7//4817/4817824_kozulina__russkiy__yazuyk_.pdf

Embedded domains

• botcraftman.ru
• img1.liveinternet.ru

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report