SUSPICIOUS — nufawixexisonog.pdf
SUSPICIOUS — nufawixexisonog.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
c191627a4058cf3d6368b16ffe4298c19c7983d7208bb96ebcc6104b64701cd5 - SHA-1:
6e7f7dd321cffbf60912ff05c17b5e9160f3d226 - MD5:
7455a5b51e535d9b726ac370cb2e9a4d - ssdeep:
768:3gGzpDzpdJ/HABBWdJ2U47NtWxpxvTD7hNnBBsVw1/e4s2Se+M5WQa1U4:QGFvp5m0DLBBsCNe4s2XAQa1U4 - TLSH:
T13A326CF35097ED4C7A8BAF83ADAB129E518AC38D2136D750448C662CD0BC6ED7F10661 - Submitted as: nufawixexisonog.pdf
- File type: pdf · Size: 45855 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=pdf%20writer%20windows%20server%202003, https://uploads.strikinglycdn.com/files/bdec2eec-2810-4511-ab2d-8fa74dd57b92/gebixinozinowe.pdf, https://uploads.strikinglycdn.com/files/3ac490d4-9062-479b-b2a4-3078d273caca/wefenilul.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=pdf%20writer%20windows%20server%202003
- https://uploads.strikinglycdn.com/files/bdec2eec-2810-4511-ab2d-8fa74dd57b92/gebixinozinowe.pdf
- https://uploads.strikinglycdn.com/files/3ac490d4-9062-479b-b2a4-3078d273caca/wefenilul.pdf
- https://uploads.strikinglycdn.com/files/6daf5e27-a496-413a-ad27-0a383985e52b/hp_officejet_pro_8600_manual_service.pdf
- https://uploads.strikinglycdn.com/files/69d75433-6973-4389-8bc8-5384469cd2be/69738297362.pdf
- https://uploads.strikinglycdn.com/files/50d0af94-f470-4903-96d1-89eda83e0a56/41404983952.pdf
- https://cdn.shopify.com/s/files/1/0501/8425/7724/files/12656042373.pdf
- https://cdn.shopify.com/s/files/1/0501/1682/1157/files/vokiv.pdf
- https://cdn.shopify.com/s/files/1/0438/5302/1334/files/travel_chess_set_near_me.pdf
- https://cdn.shopify.com/s/files/1/0497/3160/0538/files/anemia_defisiensi_g6pd.pdf
- https://cdn.shopify.com/s/files/1/0435/5689/6927/files/best_digital_dj_software_for_android.pdf
- https://uploads.strikinglycdn.com/files/f40b9b06-dc6a-4694-bb13-8167a054eb34/diwaxufipotejisilugumida.pdf
- https://uploads.strikinglycdn.com/files/c947a741-dbcf-47af-b091-214d640e2e56/xuwom.pdf
- https://uploads.strikinglycdn.com/files/150ff7d8-50af-434a-a964-e9e255a79711/kodemudelune.pdf
- https://uploads.strikinglycdn.com/files/2bc580fc-0aeb-493d-9ff3-4def8399b5af/7124872357.pdf
- https://uploads.strikinglycdn.com/files/fee6a77b-615c-45e5-a77c-b0e41fbb8b11/36046594944.pdf
- https://cdn.shopify.com/s/files/1/0486/2545/1173/files/fgo_santa_alter_event_guide.pdf
- https://cdn.shopify.com/s/files/1/0499/2381/7640/files/ffxiv_arcanist_leveling_guide.pdf
- https://cdn.shopify.com/s/files/1/0500/4017/6793/files/michael_phelps_no_limits_download.pdf
- https://cdn.shopify.com/s/files/1/0493/2360/6175/files/42316941783.pdf
- https://cdn-cms.f-static.net/uploads/4366003/normal_5f8748a41cd9e.pdf
- https://cdn-cms.f-static.net/uploads/4390680/normal_5f8ef8fa48481.pdf
- https://s3.amazonaws.com/felasorarabipis/26484558141.pdf
- https://s3.amazonaws.com/wunupalezozerud/insolvency_and_bankruptcy_rules_2016.pdf
- https://s3.amazonaws.com/figugipopar/manual_arcmap_10._2.pdf
Embedded domains
- ggtraff.ru
- uploads.strikinglycdn.com
- cdn.shopify.com
- cdn-cms.f-static.net
- s3.amazonaws.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report