MALICIOUS
74
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a high-confidence heuristic firing for a redirector link, indicating a phishing or social engineering lure. The embedded URL, http://renimba.info/wp1?keyword=%D0%B5%D0%B3%D1%8D+%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%82%D0%B8%D0%BA%D0%B0+2016+%D0%B7%D0%B0%D0%B4%D0%B0%D0%BD%D0%B8%D0%B5+14+%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE, is likely used to direct users to malicious content. While no scripts were explicitly extracted, the nature of the PDF and the redirector suggests an attempt to deliver a secondary payload or phish for credentials.
Machine Learning
- Nyx PDF Classifier malicious score 0.8002
Heuristics 3
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://renimba.info/wp1?keyword=%D0%B5%D0%B3%D1%8D+%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%82%D0%B8%D0%BA%D0%B0+2016+%D0%B7%D0%B0%D0%B4%D0%B0%D0%BD%D0%B8%D0%B5+14+%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE PDF link annotation
- http://yasobe.youtubeIn PDF document text
- http://videoegeIn PDF document text
- http://videoege.com/watch?v=NGiu7q7ZPq4In PDF document text
- http://videoege.ru/to/410011285238281In PDF document text
- http://infbu.youtubeIn PDF document text
- http://videoege.ru/pupil/podgotovka-k-oge-po-informatikeIn PDF document text
- https://www.ru/podgotovka-k-In PDF document text
- http://videoege.com/watch?v=nSDbYP_eVzYIn PDF document text
- https://money.ru/online-tests/test-zadanie-2.ru/priceIn PDF document text
- http://videoege.yandexIn PDF document text
- http://videoege.��������������In PDF document text
- http://videoege.com/watch?v=LzMWsLH2Py8In PDF document text
- http://urokidoma.youtubeIn PDF document text
- http://distan-schoolIn PDF document text
- https://www.ru/rabota-po-programmirovaniyu-na-zakazIn PDF document text
- https://www.htmlIn PDF document text
- https://www.ru/repetitor-po-bazam-dannihIn PDF document text
- http://videoege.com/informatics_100In PDF document text
- https://unkonebac1973.files.wordpress.com/2018/04/joposopalo-skachat-besplatno-igry-na-telefon-samsung-duos-gt-s6102-kefimiloketi.pdfIn PDF document text
- https://alluhoscard1974.files.wordpress.com/2018/04/gapagagezumezaw-retsept-salata-s-kalmarami-i-krabovymi-palochkami-i-iaitsom-nozupuf.pdfIn PDF document text
- https://golddocklange1971.files.wordpress.com/2018/04/misamedulekox-garri-garrison-poslednee-srazhenie-audiokniga-torrent-fujikupokulodam.pdfIn PDF document text
- https://img0.liveinternet.ru/images/attach/d/0//5912/5912296_simukispishugdzporusskomuiazyku9klasszaxaxuw.pdfIn PDF document text
- https://img0.liveinternet.ru/images/attach/d/0//5908/5908697_nexovilatchukimironovobzh9klassrabochaiatetradgdzgozuged.pdfIn PDF document text
- https://img0.liveinternet.ru/images/attach/d/0//5906/5906291_xedvseproblemyiargumentysochinenieegerusskiiiazyktaw.pdfIn PDF document text
- https://fettimicut1978.files.wordpress.com/2018/04/xalele-gdz-po-obshchestvoznaniiu-rabochei-tetradi-9-klass-kotova-zorifixifup.pdfIn PDF document text
- https://img0.liveinternet.ru/images/attach/d/0//5912/5912387_vufgdzporusskomu4klasskanakinarabochaiatetrad2chastjariv.pdfIn PDF document text
- https://inpetfipen1982.files.wordpress.com/2018/04/vuxodugizudi-goriachee-dlia-detei-na-den-rozhdeniia-retsepty-s-foto-dexisijuxup.pdfIn PDF document text
- https://tabrapoder1972.files.wordpress.com/2018/04/moguxis-kak-sdelat-dubovuiu-bochku-svoimi-rukami-foto-instruktsiia-dlia-nachinaiushchikh-biwopuwovuxos.pdfIn PDF document text
- https://zdajicparvio1983.files.wordpress.com/2018/04/tapakefolibivek-audiokniga-pro-razvedku-zamerazawo.pdfIn PDF document text
- https://inpetfipen1982.files.wordpress.com/2018/04/dejuw-gdz-ot-putina-matematika-5-klass-zubareva-2014-goda-fopalag.pdfIn PDF document text
- https://img0.liveinternet.ru/images/attach/d/0//5906/5906179_suvugegdz9klassrusskiiiazykrazumovskaia2014goddixes.pdfIn PDF document text
- https://fettimicut1978.files.wordpress.com/2018/04/jejeroxomuwa-reshebnik-po-angliiskomu-iazyku-9-klass-starlight-students-book-nejugebew.pdfIn PDF document text
- https://www.youtube.com/vladimirbabiyIn PDF document text
- https://www.com/watch?v=43bAYxJNexsIn PDF document text
- https://www.com/watch?v=pRNNxR8Fs34In PDF document text
- https://vk.youtube.com/watch?v=T99i5gz9LdwIn PDF document text
- http://videoege.youtube.com/watch?v=r7fbso6PWvsIn PDF document text
- https://www.youtubeIn PDF document text
- https://www.com/watch?v=9E0BaCbuAEUIn PDF document text
- https://www.com/watch?v=_y5dmvvbS8UIn PDF document text
- https://vk.com/watch?v=zcQ_p9c7JMMIn PDF document text
- https://www.com/watchIn PDF document text
- https://www.com/watch?v=We2_qXgb2J8In PDF document text
- https://vk.youtube.youtube.ru/na/infbuIn PDF document text
- https://www.com/watch?v=RYGwisN-Eo4In PDF document text
- https://www.youtube.com/watch?v=6bCbHX1zui8In PDF document text
- https://img1.liveinternet.ru/images/attach/d/0//5911/5911734_bopreshebnikgia2013matematikasemenovaiashchenkolob.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (stream_007_off0002e7ac.bin)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_002_off0000a48f.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0xA48F | 1485561 bytes |
SHA-256: 1718db8b7c6a44712dc1b3acee434281abf7527ebf6ea299260c2277eb5af585 |
|||
stream_007_off0002e7ac.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x2E7AC | 34432 bytes |
SHA-256: 57f505b04be085e8eff40c024fe1cb14df055ffee3cd5db6f3ec7bc26ad37ee1 |
|||
font_01_sfnt_off00033608.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x33608 | 15736 bytes |
SHA-256: 201ffa20c03edf3c214ca332e2d629addca88fd637c77ca4b4fe350f351160db |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.