MALICIOUS — mikuxowubawumowiwidu.pdf

MALICIOUS — mikuxowubawumowiwidu.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 52 detection engines flagged it.

Identification

• SHA-256: 2f02f2db38a2adc125488fceeec7d27c337e625e9d8cd23c7b954b90c023da3f
• SHA-1: 53b16c9afb989255f535b91867781c470d881a38
• MD5: 5aafafb133bf6e97238476973f75fd63
• ssdeep: 3072:fFxC/nS2LeY6NBy/w8L+eQlsfcX4jMQo+QMlfAgng/ZN29:dt2Z6NY/lCUdov82ZI
• TLSH: T1433DF1F38157DC4D2E8F5B432A8614ADA1259A4C3036AF792AA0365CD93C7FD1E80E31
• Submitted as: mikuxowubawumowiwidu.pdf
• File type: pdf · Size: 125364 bytes
• Verdict: malicious (78/100)

Detections (2 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=aphasia+therapy+materials+pdf, https://cdn.shopify.com/s/files/1/0431/0161/8327/files/harry_potter_theme_tune_flute_sheet.pdf, https://cdn.shopify.com/s/files/1/0440/2262/8502/files/free_robux_groups_roblox.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ggtraff.ru/strik?keyword=aphasia+therapy+materials+pdf
• https://cdn.shopify.com/s/files/1/0431/0161/8327/files/harry_potter_theme_tune_flute_sheet.pdf
• https://cdn.shopify.com/s/files/1/0440/2262/8502/files/free_robux_groups_roblox.pdf
• https://cdn.shopify.com/s/files/1/0435/4126/6591/files/64807295851.pdf
• https://cdn.shopify.com/s/files/1/0431/7993/3862/files/poguzagegibo.pdf
• https://cdn.shopify.com/s/files/1/0460/6518/9019/files/xuzelitotorepamemowime.pdf
• https://cdn.shopify.com/s/files/1/0431/7547/7416/files/wixivawujoxoxodevosof.pdf
• https://cdn.shopify.com/s/files/1/0430/6989/8903/files/managimiragulo.pdf
• https://cdn.shopify.com/s/files/1/0434/1530/6405/files/stone_middle_school_address.pdf
• https://cdn.shopify.com/s/files/1/0432/2063/1720/files/dekadataxowetedala.pdf
• http://files.c2lconference.com/uploads/1/3/1/4/131453897/gugadelug_gilodajol.pdf
• http://files.nuovamarea.net/uploads/1/3/0/7/130775309/f7f0c93dd20e74.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• cdn.shopify.com
• files.c2lconference.com
• files.nuovamarea.net
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report