SUSPICIOUS — fawafibifiguj.pdf
SUSPICIOUS — fawafibifiguj.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 4 of 50 detection engines flagged it.
Identification
- SHA-256:
d98b7408b7f97b7a687f5d42f1f212dc0bbb42054c00020e6d2bbba80e2dd05a - SHA-1:
6315a42c8303793773f0289dce3f8baa69808bad - MD5:
9271ef199f3b2b12e6dfe4d37cf1638f - ssdeep:
1536:l/TLtpYyHFRcFbwEy5UwyjBWxP4xPGJEN5HS2rGGzsZz7WwpOS9WmEdRncz71HNA:9b/Rcp+5UweYxP0PzPGGmeSan2716 - TLSH:
T16639CFF36197EE4C77969B4379E60198A14AD2883162EFA144843B3CD57CABE7F10902 - Submitted as: fawafibifiguj.pdf
- File type: pdf · Size: 88168 bytes
- Verdict: suspicious (44/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://queure.ru/uplcv?utm_term=chi+square+test+dependent+variable, https://eseninternational.com/uploads/files/85423260595.pdf, http://www.mueblesgamez.com/ckfinder/userfiles/files/giwenevudedoluselo.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://queure.ru/uplcv?utm_term=chi+square+test+dependent+variable
- https://eseninternational.com/uploads/files/85423260595.pdf
- http://www.mueblesgamez.com/ckfinder/userfiles/files/giwenevudedoluselo.pdf
- https://rmissio.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16111acca17664---fobodonilogivifoja.pdf
- https://bio86.net/fichiers/jaguwovisaferar.pdf
- https://controlcert.se/wp-content/plugins/formcraft/file-upload/server/content/files/160a8bf899a682---96973220178.pdf
- https://pensiunea-escape.ro/ckfinder/userfiles/files/59915981975.pdf
- http://absolutelyneon.com/userfiles/file/rafolivavupop.pdf
- https://giriconsultancy.com/content_files/files/fojexaxemuwe.pdf
- http://www.allatpatikapecs.hu/images/file/rizaj.pdf
- http://istihdamhaberleri.com/upload/ckfinder/files/xesiguwufeku.pdf
- https://next-engineering.com/userfiles/files/xomifix.pdf
- https://www.colline-eternelle.com/ckfinder/userfiles/files/fawuvuroledabada.pdf
- http://shmgec.com/Uploadfiles/files/welaridi.pdf
- http://selidbe-beograd.info//files/vifidufapekes.pdf
- http://kd-council.com/upfile/files/93714653012.pdf
- http://birnagarcollege.in/userfiles/file/37997009296.pdf
- https://socialchangefactory.org/wp-content/plugins/super-forms/uploads/php/files/51a5b563c9d779bf09ecb7fb5886f087/rufusababivetifabum.pdf
- https://prokoncept.hu/admin/blogfck/image/file/78024688063.pdf
- https://anzmrrn.org/wp-content/plugins/formcraft/file-upload/server/content/files/160afaebb02b61---93489229649.pdf
- https://ilonew.tasksplan.com/userfiles/files/viponotoboguleborirufa.pdf
- https://askisan.com/upload/ckfinder/files/sirekojule.pdf
- http://mini-garden.ru/userfiles/file/33948281143.pdf
- http://www.radeton-cz.vasestranky.cz/ckfinder/userfiles/files/busipewopemexodizatawu.pdf
- http://www.kevinbrooks.ca/wp-content/plugins/formcraft/file-upload/server/content/files/16109146152c36---18215348503.pdf
Embedded domains
- queure.ru
- eseninternational.com
- www.mueblesgamez.com
- rmissio.pl
- bio86.net
- controlcert.se
- absolutelyneon.com
- giriconsultancy.com
- istihdamhaberleri.com
- next-engineering.com
- www.colline-eternelle.com
- shmgec.com
- selidbe-beograd.info
- kd-council.com
- birnagarcollege.in
- socialchangefactory.org
- anzmrrn.org
- ilonew.tasksplan.com
- askisan.com
- mini-garden.ru
- www.kevinbrooks.ca
- www.w3.org
- purl.org
- ns.adobe.com
- pensiunea-escape.ro
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report