SUSPICIOUS — dimij.pdf
SUSPICIOUS — dimij.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
7c4a7c812b4efb2418a075816a982d760cb5abf01bdc7399e8cb07df9c478434 - SHA-1:
574d51ad553d8525714ba457bb0f4ba8cfae42db - MD5:
fbe04faa0a91335d54cb8b2a88836f43 - ssdeep:
768:EgGzpDWpEMo1+TRhE9HhilGGWzzhHTMT+8xpKd52AibLJcwv1euCkymKpnW9mo3X:xGFapyGWz9MxmkcwIuCkbKpdo6W4S - TLSH:
T1BC327CF310A7DC9C3B8B5B57A9AA629C6059DB4D6033E66044C8772CD07C6BD2E04D32 - Submitted as: dimij.pdf
- File type: pdf · Size: 45873 bytes
- Verdict: suspicious (58/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://cdn-cms.f-static.net/uploads/4366033/normal_5f8725aac5351.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=toshiba%20fire%20tv%2043lf621u19%20manual, https://cdn.shopify.com/s/files/1/0441/2892/7896/files/zee_tv_live_serial_online_kumkum_bhagya.pdf, https://cdn.shopify.com/s/files/1/0433/9151/6839/files/21520156049.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=toshiba%20fire%20tv%2043lf621u19%20manual
- https://cdn.shopify.com/s/files/1/0441/2892/7896/files/zee_tv_live_serial_online_kumkum_bhagya.pdf
- https://cdn.shopify.com/s/files/1/0433/9151/6839/files/21520156049.pdf
- https://cdn.shopify.com/s/files/1/0498/2741/4171/files/fluency_passages_6th_grade.pdf
- https://cdn.shopify.com/s/files/1/0493/7187/3446/files/12225434455.pdf
- https://cdn-cms.f-static.net/uploads/4366033/normal_5f8725aac5351.pdf
- https://cdn-cms.f-static.net/uploads/4366666/normal_5f8835660b228.pdf
- https://cdn-cms.f-static.net/uploads/4368468/normal_5f87aaba5b159.pdf
- https://cdn-cms.f-static.net/uploads/4365638/normal_5f881be9afa89.pdf
- https://cdn-cms.f-static.net/uploads/4365608/normal_5f879e73cf76d.pdf
- https://cdn-cms.f-static.net/uploads/4369771/normal_5f888509cc81d.pdf
- https://cdn-cms.f-static.net/uploads/4365549/normal_5f87114954074.pdf
- https://cdn-cms.f-static.net/uploads/4366044/normal_5f8763e998396.pdf
- https://site-1037212.mozfiles.com/files/1037212/88548944108.pdf
- https://site-1043791.mozfiles.com/files/1043791/bevumafev.pdf
- https://site-1043686.mozfiles.com/files/1043686/commonly_misspelled_words_in_english_worksheets.pdf
- https://site-1037000.mozfiles.com/files/1037000/50604657025.pdf
- https://site-1036957.mozfiles.com/files/1036957/30470912042.pdf
- https://cdn-cms.f-static.net/uploads/4366050/normal_5f87650dc545d.pdf
- https://cdn-cms.f-static.net/uploads/4366647/normal_5f8860a465100.pdf
- https://jiwepurojal.weebly.com/uploads/1/3/0/7/130775762/lupemu_lumivexojadojex_bubufudisujexi_logejilobarug.pdf
- https://vuxozajuje.weebly.com/uploads/1/3/1/3/131379873/3257372.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- cctraff.ru
- cdn.shopify.com
- cdn-cms.f-static.net
- site-1037212.mozfiles.com
- site-1043791.mozfiles.com
- site-1043686.mozfiles.com
- site-1037000.mozfiles.com
- site-1036957.mozfiles.com
- jiwepurojal.weebly.com
- vuxozajuje.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report