MALICIOUS — wuzuserubopo.pdf
MALICIOUS — wuzuserubopo.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (77/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
74796bee6789e305205cea133195dd04eae6e9e59bcc7f1dc961a6993b1b9b7b - SHA-1:
fd9e390850d398647bb18b6d80eaded9f42dc4ff - MD5:
129e08325ce566419e57216a0a0aa5de - ssdeep:
768:AgGzpDNph6mDGLSt73Wvlc2r1jMCHPcV7H+LAhbPxp0mDXsJ4Nc:NGFpphV7thbPT/DcJ4Nc - TLSH:
T104318DF350A3ED8D7A8BAB03AAAA116D658AC78D6027D39004CC372DC47C5ED6E40A51 - Submitted as: wuzuserubopo.pdf
- File type: pdf · Size: 39480 bytes
- Verdict: malicious (77/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The malicious score of 77/100 is the fusion of 5 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/988b8d1f-4a11-41bf-b244-3ba74ca8c31c/tiligemibogosu.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=pokemon%20fire%20red%20v%201.0%20rom, https://cdn.shopify.com/s/files/1/0497/9825/0660/files/67549943689.pdf, https://cdn.shopify.com/s/files/1/0497/5978/1023/files/new_year_sermon_topics.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=pokemon%20fire%20red%20v%201.0%20rom
- https://cdn.shopify.com/s/files/1/0497/9825/0660/files/67549943689.pdf
- https://cdn.shopify.com/s/files/1/0434/0377/2056/files/vernon_county_wi.pdf
- https://cdn.shopify.com/s/files/1/0497/5978/1023/files/new_year_sermon_topics.pdf
- https://cdn.shopify.com/s/files/1/0431/2137/7434/files/speech_goals_for_hearing_loss.pdf
- https://uploads.strikinglycdn.com/files/988b8d1f-4a11-41bf-b244-3ba74ca8c31c/tiligemibogosu.pdf
- https://uploads.strikinglycdn.com/files/f5251e2d-981a-475d-a1d3-fbdaefa448de/fijofovipitisebezokesebaz.pdf
- https://uploads.strikinglycdn.com/files/f946bca5-6aca-473e-a591-2d5a95014cd1/nuwobusilege.pdf
- https://cdn-cms.f-static.net/uploads/4379359/normal_5f8cb88fa429a.pdf
- https://cdn-cms.f-static.net/uploads/4376362/normal_5f8c4aaf16faa.pdf
- https://cdn-cms.f-static.net/uploads/4376879/normal_5f8c4deb89f25.pdf
- https://cdn-cms.f-static.net/uploads/4367281/normal_5f8d56214bba4.pdf
- https://cdn-cms.f-static.net/uploads/4367642/normal_5f8818c06d839.pdf
- https://cdn-cms.f-static.net/uploads/4378618/normal_5f8da5eb5907a.pdf
- https://cdn-cms.f-static.net/uploads/4366020/normal_5f8a15c694630.pdf
- https://cdn-cms.f-static.net/uploads/4365536/normal_5f889d442b19d.pdf
- https://cdn-cms.f-static.net/uploads/4368777/normal_5f879d02d4917.pdf
- https://sokuvotaboraj.weebly.com/uploads/1/3/0/7/130776263/a85eca3228e8.pdf
- https://gibitiwatu.weebly.com/uploads/1/3/0/7/130776060/e828ef01abe12.pdf
- https://cdn.shopify.com/s/files/1/0429/2807/9004/files/lilesaxarefedefut.pdf
- https://cdn.shopify.com/s/files/1/0501/8304/5293/files/24037161049.pdf
- https://cdn.shopify.com/s/files/1/0496/1049/0022/files/tapone.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- gettraff.ru
- cdn.shopify.com
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- sokuvotaboraj.weebly.com
- gibitiwatu.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report