SUSPICIOUS — 4819341_skachat__urban__crime_.pdf

SUSPICIOUS — 4819341_skachat__urban__crime_.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: cdeb4d2a80c1103dcd49050cb20423d7b987f4977bbc45902ab03043a7479326
• SHA-1: 05cb90c98cf852a69be6fd246a44472e32d5d855
• MD5: bcc6f00f69bfc1cfe62cb062073e2099
• ssdeep: 6144:zlbfOpOnb8WsZ/Rbqbdh0nc5B+scZq7SvajbtthmiNwCPj/+r6Z6PWjBqEH5a:zlb2p24WaNqdumbnsawQiO8cQUa
• TLSH: T1004801F1ED05ADB8D9CCBF637A25413C6E061B4609F16731242759E672B52AB230A333
• Submitted as: 4819341_skachat__urban__crime_.pdf
• File type: pdf · Size: 373192 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.13
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: http://botcraftman.ru/?lip&keyword=%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+urban+crime+%D0%BD%D0%B0+%D0%B0%D0%BD%D0%B4%D1%80%D0%BE%D0%B8%D0%B4&charset=utf-8, http://img1.liveinternet.ru/images/attach/c/7//4819/4819178_skachat__film__otkroyte_.pdf, http://img1.liveinternet.ru/images/attach/c/7//4819/4819104_staruye__kartuy__shuberta_.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://botcraftman.ru/?lip&keyword=%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+urban+crime+%D0%BD%D0%B0+%D0%B0%D0%BD%D0%B4%D1%80%D0%BE%D0%B8%D0%B4&charset=utf-8
• http://img1.liveinternet.ru/images/attach/c/7//4819/4819178_skachat__film__otkroyte_.pdf
• http://img1.liveinternet.ru/images/attach/c/7//4819/4819104_staruye__kartuy__shuberta_.pdf
• http://img1.liveinternet.ru/images/attach/c/7//4817/4817988_.pdf

Embedded domains

• botcraftman.ru
• img1.liveinternet.ru

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report