MALICIOUS — 4802684_atlant__raspravil__plechi_.pdf

MALICIOUS — 4802684_atlant__raspravil__plechi_.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: d7b6b39a3f2a41a7df012f3abdb0aeb05b64b5ecc0595b68302445f0675585e6
• SHA-1: 50f469ed23c8b07d64d4a85205738b24899185b9
• MD5: 125c08b96d20181feca8880e47453954
• ssdeep: 6144:uVFd50X6NJVUJdku2DXPFL7GDbhNZojdVTz/DYDs2yHY5xMRme8wrNEL4zzaYHiQ:Wd5tNJVoKu2DfxQZoZxDYDO45oF8wuLY
• TLSH: T19C4912F1F9039624DA997F6B3F3C642D352A861A11F12730387249BAB2F1677070A572
• Submitted as: 4802684_atlant__raspravil__plechi_.pdf
• File type: pdf · Size: 391994 bytes
• Verdict: malicious (75/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.13
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 75/100 is the fusion of 4 weighted signals:

• Embedded link rated malicious by URL analysis: http://img0.liveinternet.ru/images/attach/c/7//4802/4802566_domennuye__sluzhbuy__active_.pdf - network signal, weight 0.70, confidence 0.80
• Embedded network infrastructure: http://botcraftman.ru/?lip&keyword=%D0%B0%D1%82%D0%BB%D0%B0%D0%BD%D1%82+%D1%80%D0%B0%D1%81%D0%BF%D1%80%D0%B0%D0%B2%D0%B8%D0%BB+%D0%BF%D0%BB%D0%B5%D1%87%D0%B8+%D0%BA%D0%BD%D0%B8%D0%B3%D0%B0+3+%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE&charset=utf-8, http://img0.liveinternet.ru/images/attach/c/7//4802/4802566_domennuye__sluzhbuy__active_.pdf, http://img0.liveinternet.ru/images/attach/c/7//4802/4802589_ipa__fayluy_.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://botcraftman.ru/?lip&keyword=%D0%B0%D1%82%D0%BB%D0%B0%D0%BD%D1%82+%D1%80%D0%B0%D1%81%D0%BF%D1%80%D0%B0%D0%B2%D0%B8%D0%BB+%D0%BF%D0%BB%D0%B5%D1%87%D0%B8+%D0%BA%D0%BD%D0%B8%D0%B3%D0%B0+3+%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE&charset=utf-8
• http://img0.liveinternet.ru/images/attach/c/7//4802/4802566_domennuye__sluzhbuy__active_.pdf
• http://img0.liveinternet.ru/images/attach/c/7//4802/4802589_ipa__fayluy_.pdf
• http://img0.liveinternet.ru/images/attach/c/7//4802/4802365_funbox__skachat_.pdf

Embedded domains

• botcraftman.ru
• img0.liveinternet.ru

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report