SUSPICIOUS — 4683395_qrolik_koduy.pdf
SUSPICIOUS — 4683395_qrolik_koduy.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 1 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
321d097c3ec5d20a30ac680ce24372403192fdfdb45fbcb241016a73689650e4 - SHA-1:
ad5320f74c27907206a2e55f752e635100cde295 - MD5:
0332f6ceb8efc683b55c6dc6591e87f6 - ssdeep:
6144:6u1lF0ljHoUqQw/Qmm40zYL1uU5dL9pbNhO6YL:6WqxhWXm40soUppb7g - TLSH:
T1914602F25E14DA0EC65C37627E2484BF1D59148260F0273278B3A3A77274AB7770A279 - Submitted as: 4683395_qrolik_koduy.pdf
- File type: pdf · Size: 305034 bytes
- Verdict: suspicious (58/100)
Detections (1 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: http://img1.liveinternet.ru/images/attach/c/6//4683/4683344_doch_pekarya_sara_makkoy_skachat_knigu_besplatno.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: http://botcraftman.ru/?lip&keyword=qrolik+%D0%BA%D0%BE%D0%B4%D1%8B&charset=utf-8, http://img1.liveinternet.ru/images/attach/c/6//4683/4683344_doch_pekarya_sara_makkoy_skachat_knigu_besplatno.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://botcraftman.ru/?lip&keyword=qrolik+%D0%BA%D0%BE%D0%B4%D1%8B&charset=utf-8
- http://img1.liveinternet.ru/images/attach/c/6//4683/4683344_doch_pekarya_sara_makkoy_skachat_knigu_besplatno.pdf
Embedded domains
- botcraftman.ru
- img1.liveinternet.ru
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report