SUSPICIOUS — 4805545_2014_____.pdf

SUSPICIOUS — 4805545_2014_____.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 1 of 53 detection engines flagged it.

Identification

SHA-256: f6aefe571bfb19fa0a1d7f5fc30799c21040affa00ba4a1922abf0018199e446
SHA-1: 6073f35b4b0b0b1f583f01da9d3c00c7544196ae
MD5: 9c9a26285a9b410dafbf9e635251f78b
ssdeep: 6144:NkcimDkSjKg0wJ0THUbk/8KkZS8jZh2JVQfVh:ZimDxe7T0BQ8tz
TLSH: T1894602F5DB16EA78DB6C3A123E20143E7C1A122649F06B752D170CEB72B467B2318572
Submitted as: 4805545_2014_____.pdf
File type: pdf · Size: 294521 bytes
Verdict: suspicious (44/100)

Detections (1 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

Embedded network infrastructure: http://botcraftman.ru/?lip&keyword=2014+++++2014&charset=utf-8, http://img1.liveinternet.ru/images/attach/c/7//4803/4803728_multfilmuy__suteeva__skachat_.pdf, http://img0.liveinternet.ru/images/attach/c/7//4804/4804544_skachat__besplatno__i_.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

http://botcraftman.ru/?lip&keyword=2014+++++2014&charset=utf-8
http://img1.liveinternet.ru/images/attach/c/7//4803/4803728_multfilmuy__suteeva__skachat_.pdf
http://img0.liveinternet.ru/images/attach/c/7//4804/4804544_skachat__besplatno__i_.pdf
http://img1.liveinternet.ru/images/attach/c/7//4803/4803696_skachat__standartnuyy__shrift_.pdf

Embedded domains

botcraftman.ru
img1.liveinternet.ru
img0.liveinternet.ru

File paths

r:\zz

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report