SUSPICIOUS — wenugisi.pdf
SUSPICIOUS — wenugisi.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
c14c85f7b5b50ef7d3b3e206d502242e3379a2e971d2ba9e1d4ab6a64f195617 - SHA-1:
d13e6532514c9a36e42c8ab8beb3cd72991f44ee - MD5:
4652aa2bcd02efb4934827fb4489fe8d - ssdeep:
1536:++8o45en5dH6aOIzAdR/rEmcy/fwn/Th1fNFcfRFThrzWu5dumn/Q2IUDW8pO7sP:j8H7IS/rwOO1fAfTJr5dumoJUu70 - TLSH:
T10638C0F321B7EE4CBB5A8F0369B712987189D38C1066DB901188B67CD87C6BE7E50901 - Submitted as: wenugisi.pdf
- File type: pdf · Size: 83083 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://huntic.ru/uplcv?utm_term=rpg+play+store, http://www.casasemio.com.br/ckfinder/userfiles/files/85698831653.pdf, http://www.contal-farmer.com/uploads/files/97307499996.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://huntic.ru/uplcv?utm_term=rpg+play+store
- http://www.casasemio.com.br/ckfinder/userfiles/files/85698831653.pdf
- http://www.contal-farmer.com/uploads/files/97307499996.pdf
- https://volpatoebrum.com.br/_common/admin/scripts/ckfinder/userfiles/files/zutokal.pdf
- http://f-okinawa.com/img/tmp/files/61217870032.pdf
- http://autovoda.ru/upload/files/43532183003.pdf
- https://hogozaty.com/ckfinder/userfiles/files/wareduw.pdf
- http://indiebookoftheday.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613a3bb1cc36a---5051311211.pdf
- http://on-video.com/movies/movie_data/file/botalagazurokotigege.pdf
- http://tuning-zone.eu/userfiles/file/58783789013.pdf
- http://cephedanismani.com/images/pages/file/porufitadozugi.pdf
- https://aakritidigitals.com/userfiles/files/guwinotemenujaze.pdf
- http://ambvetsanprospero.eu/userfiles/files/8125907591.pdf
- https://northwestconvention.cz/data/files/nukas.pdf
- https://energiadirect.pl/application/resources/ckfinder/userfiles/files/9255690689.pdf
- http://weddingdove.tw/uploads/files/202109030329168682.pdf
- https://gulfcans.com/home/madarmun/public_html/gulfcans/images/bulk_images/files/67122701355.pdf
- http://mayinmaunhat.com/upload/files/velilewe.pdf
- http://zeminyerkaplama.com/upload/ckfinder/files/5152486675.pdf
- http://uyaviation.com/wp-content/plugins/formcraft/file-upload/server/content/files/161361e44c4372---kadirikagulewipasusado.pdf
- http://strelnicebudejovice.cz/userfiles/file/tematuvaxewodinemepog.pdf
- https://www.xcelsus.de/wp-content/plugins/formcraft/file-upload/server/content/files/161410f37485e5---42761890637.pdf
- https://unitedcardsolutions.com/wp-content/plugins/formcraft/file-upload/server/content/files/16138acf931411---sawujazufuboba.pdf
- https://asharfilalkulfi.com/ckfinder/userfiles/files/50451076527.pdf
- http://fratellibeninca.com/images/file/65686251360.pdf
Embedded domains
- huntic.ru
- www.casasemio.com.br
- www.contal-farmer.com
- volpatoebrum.com.br
- f-okinawa.com
- autovoda.ru
- hogozaty.com
- indiebookoftheday.com
- on-video.com
- tuning-zone.eu
- cephedanismani.com
- aakritidigitals.com
- ambvetsanprospero.eu
- energiadirect.pl
- weddingdove.tw
- gulfcans.com
- mayinmaunhat.com
- zeminyerkaplama.com
- uyaviation.com
- www.xcelsus.de
- unitedcardsolutions.com
- asharfilalkulfi.com
- fratellibeninca.com
- photopuzzle.net
- www.w3.org
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report