SUSPICIOUS — fazuwivir_nigoluvevix_vojewanoluwexa.pdf
SUSPICIOUS — fazuwivir_nigoluvevix_vojewanoluwexa.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (35/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
a9d2a8293cc17e2636b2a10540c104194e813ffdc2533c9565cfae8079594004 - SHA-1:
5f4096fd3591d0f0b3ee279c8d957fea1e0fe866 - MD5:
af0a0684e6ba78653306dbf44b4817fd - ssdeep:
768:PgGzpDFp7xj20U+AonBBt4QbbaZObjUZbUa57rlQHxl:4GFxpdcibaIbjAh59QHxl - TLSH:
T17A316CF340A3ED4DBACBDB437DE72559A049CA4C6122A79448982B6CC4BC6BD7F00D61 - Submitted as: fazuwivir_nigoluvevix_vojewanoluwexa.pdf
- File type: pdf · Size: 42172 bytes
- Verdict: suspicious (35/100)
Detections (2 of 50 engines)
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 35/100 is the fusion of 2 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=zil%20sesi%20indir%20ilahi, https://cdn.shopify.com/s/files/1/0496/0469/0069/files/total_gym_xls_walmart.pdf, https://cdn.shopify.com/s/files/1/0462/7342/9661/files/quikchange_ii_manual.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=zil%20sesi%20indir%20ilahi
- https://cdn.shopify.com/s/files/1/0496/0469/0069/files/total_gym_xls_walmart.pdf
- https://cdn.shopify.com/s/files/1/0462/7342/9661/files/quikchange_ii_manual.pdf
- https://cdn.shopify.com/s/files/1/0434/5335/0053/files/rcbs_green_machine_parts_for_sale.pdf
- https://cdn.shopify.com/s/files/1/0493/1806/8383/files/58721150738.pdf
- https://uploads.strikinglycdn.com/files/f683d73b-29a4-4142-b17a-a751c3ff141d/60043398897.pdf
- https://site-1038973.mozfiles.com/files/1038973/88961989682.pdf
- https://site-1036689.mozfiles.com/files/1036689/79064183176.pdf
- https://site-1043218.mozfiles.com/files/1043218/48271618721.pdf
- https://site-1039959.mozfiles.com/files/1039959/sinewajoj.pdf
- https://site-1041846.mozfiles.com/files/1041846/14244160250.pdf
- https://site-1039478.mozfiles.com/files/1039478/tosubovirisivarazozasuton.pdf
- https://site-1038780.mozfiles.com/files/1038780/dejerirelevabaladesinubag.pdf
- https://site-1038531.mozfiles.com/files/1038531/tirejawoxenejovuzenotodet.pdf
- https://site-1041208.mozfiles.com/files/1041208/41034747496.pdf
- https://cdn-cms.f-static.net/uploads/4366982/normal_5f87760b1ee5a.pdf
- https://cdn-cms.f-static.net/uploads/4365662/normal_5f876b9b8bc1b.pdf
- https://cdn-cms.f-static.net/uploads/4366043/normal_5f8785c285527.pdf
- https://cdn-cms.f-static.net/uploads/4366344/normal_5f876ac751706.pdf
- https://site-1040504.mozfiles.com/files/1040504/99957766373.pdf
- https://site-1043653.mozfiles.com/files/1043653/tagujewagitivavi.pdf
- https://site-1042887.mozfiles.com/files/1042887/59518700361.pdf
- https://site-1039897.mozfiles.com/files/1039897/dogogikesunedov.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- ggtraff.ru
- cdn.shopify.com
- uploads.strikinglycdn.com
- site-1038973.mozfiles.com
- site-1036689.mozfiles.com
- site-1043218.mozfiles.com
- site-1039959.mozfiles.com
- site-1041846.mozfiles.com
- site-1039478.mozfiles.com
- site-1038780.mozfiles.com
- site-1038531.mozfiles.com
- site-1041208.mozfiles.com
- cdn-cms.f-static.net
- site-1040504.mozfiles.com
- site-1043653.mozfiles.com
- site-1042887.mozfiles.com
- site-1039897.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report