MALICIOUS
70
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The critical heuristic PDF_REPEATED_PAYLOAD_LINK_LURE indicates that the PDF contains multiple invisible links designed to trick the user into downloading a payload. The extracted URL http://www.gks.ru/free_doc/doc_2016/bul_dr/mun_obr2016.rar is identified as the target of these links, suggesting a delivery mechanism for a malicious archive. The PDF_URI heuristic also points to an external PDF, potentially for further obfuscation or as part of the lure.
Machine Learning
- Nyx PDF Classifier clean score 0.0084
Heuristics 3
-
Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LUREPDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
-
External URI low PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://ugraoopt.ru/istoriya-zapovednogo-otdela/istoriya-razvitiya-osobo-okhranyaemykh-prirodnykh-territoriy- In PDF document text
- http://ugrales.ru/files/prezent/2017/Itogi_2016.pptxIn PDF document text
- http://www.dzhmao.ru/info/perechen-sanatorno-kuro.phpIn PDF document text
- http://www.journal-discussion.ru/publication.php?id=1500In PDF document text
- http://admsurgut.ru/files/oldfiles/dm122180_0.docIn PDF document text
- http://www.dumahmao.ru/ai_fill/File/MSU/InfmethodCollect/Infometodcollect_17_2015_zas_al.pdfIn PDF document text
- http://iknugra.ru/istoriko-kulturnoe-nasledie-yugri/In PDF document text
- http://stariy-surgut.ru/turistsko-informatsionnyy-tsentr/kulturno-poznavatelnyy-turizm/In PDF document text
- http://iknugra.ru/istoriko-kulturnoe-nasledie-yugri/dostoprimechatelnie-mesta/barsova-gora/In PDF document text
- http://www.vizitugra.ru/nvtur.html#description_1072In PDF document text
- http://ugrales.ru/press-sluzhba/1692-religioznyj-turizm-odin-iz-prioritetnykh-vidov-razvitiya-sfery-In PDF document text
- http://iknugra.ru/istoriko-kulturnoe-nasledie-yugri/dostoprimechatelnie-mesta/yuilskiy-ostrog/In PDF document text
- http://iknugra.ru/istoriko-kulturnoe-nasledie-yugri/dostoprimechatelnie-mesta/gorodok-emder/In PDF document text
- http://xn--80aafdjbbvz3abujk7c0k.xn--p1ai/?page_id=1009In PDF document text
- http://www.adm.ugorsk.ru/news/26372/In PDF document text
- http://ugrales.ru/files/itogy_goda/2015/otchet_o_razvit_sfery_turizma_2015.pdfIn PDF document text
- http://www.samotlorfest.ru/rasp.phpIn PDF document text
- http://atlas.socpol.ru/maps/HMAO_map.gifIn PDF document text
- http://www.zapoved.net/images/maps/KhantyMansiiskii.gifIn PDF document text
- http://xn--80aahfjo8abu2l.xn--p1ai/manyfaces/staff/In PDF document text
- http://86q.ru/imag/karta.gifIn PDF document text
- http://ecofest-ugra.ru/In PDF document text
- http://hmao.kaisa.ru/object/1808728563?lc=ruIn PDF document text
- http://www.communitywalk.com/ugraIn PDF document text
- https://www.avtodispetcher.ru/distance/In PDF document text
- https://www.dataplus.ruIn PDF document text
- http://ugrales.ru/files/itogy_goda/2015/In PDF document text
- http://ugrales.ru/files/prezent/In PDF document text
- http://ugrales.ru/files/prezent/2017/In PDF document text
- http://ugrales.ru/press-In PDF document text
- http://www.zapoved.net/images/maps/In PDF document text
- http://iknugra.ru/istoriko-In PDF document text
- http://stariy-surgut.ru/In PDF document text
- http://ugraoopt.ru/istoriya-zapovednogo-otdela/istoriya-razvitiya-In PDF document text
- http://www.samotlor-50.ru/fakt/In PDF document text
- http://atlas.socpol.ru/maps/In PDF document text
- http://iknugra.ru/istoriko-kulturnoe-nasledie-yugri/dostoprimechatelnie-mesta/In PDF document text
- http://iknugra.ru/istoriko-kulturnoe-In PDF document text
- https://www.dataplus.ru)endobj1414In PDF document text
- https://www.avtodispetcher.ru/distance/)endobj1376In PDF document text
- http://www.communitywalk.com/ugra)endobj1343In PDF document text
- http://hmao.kaisa.ru/object/1808728563?lc=ru)endobj1329In PDF document text
- http://www.boxinghmao.ru)endobj1283In PDF document text
- http://www.muzgeo.ru)endobj1276In PDF document text
- http://www.ugramegasport.ru)endobj1275In PDF document text
- http://www.shc-ugra.ru)endobj1269In PDF document text
- http://www.ugrasport.com)endobj1252In PDF document text
- http://ecofest-ugra.ru/)endobj1245In PDF document text
- http://www.ugrasport.com)endobj1237In PDF document text
- http://www.zapoved.net/images/maps/KhantyMansiiskii.gif)endobj1165In PDF document text
+95 more URL(s)
Extracted artifacts 15
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_083_off00095410.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x95410 | 543000 bytes |
SHA-256: b4e5257a34dbcc07f7fc454e62f6a4b7e4409666df8cfeda03d8fe9f0cfd5060 |
|||
stream_090_off000e2a41.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0xE2A41 | 4194304 bytes |
SHA-256: 8450aadff05bf6b68d36a9ba51fc5b63f942909e259747ce0ccafedd6d5114ce |
|||
stream_092_off000fd8fa.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0xFD8FA | 1437240 bytes |
SHA-256: ec91cad51ca49cc2f8dd35944eaf400d464d23f8183477d44f6015be1a689460 |
|||
stream_094_off0018c068.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x18C068 | 1216152 bytes |
SHA-256: 98f91b479d447f67dfb5a96edb3331d685efe39ca270b17693ac07c205f9b372 |
|||
stream_100_off004dd6b8.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x4DD6B8 | 31268 bytes |
SHA-256: a39657c03c0145c86ec3fd9b0e25a62a92ed29494fed95d4365609d3ec065097 |
|||
icc_00_off000008f9.icc |
pdf-icc-profile | PDF ICC profile at offset 0x8F9 | 4456 bytes |
SHA-256: ee2f821d16d12ec9e9f2958ac8865f40912d0ce1fb9625a31b594fab942b1caf |
|||
icc_01_off000016c1.icc |
pdf-icc-profile | PDF ICC profile at offset 0x16C1 | 3144 bytes |
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e |
|||
font_00_sfnt_off004c7e92.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4C7E92 | 51536 bytes |
SHA-256: b3f078f1ebbd7d8261c37b1b5a0fb3686d06b4626562ce161abf2927009bfe51 |
|||
font_01_sfnt_off004d18ed.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4D18ED | 39336 bytes |
SHA-256: d569259459ef5292c6de1c38876f9261e6201570f8fc4cc6f1bfa43e76d7251f |
|||
font_02_sfnt_off004d8b57.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4D8B57 | 8932 bytes |
SHA-256: 179c25569bb08ef85882d56d933f83a4f4ed9bd8c73251f4c74b9739f498fba4 |
|||
font_03_sfnt_off004da009.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4DA009 | 3968 bytes |
SHA-256: f6258bdbd37f692ce67cabd76c005d2c0c3d33cd728838415b174868fbef7e14 |
|||
font_04_sfnt_off004dac68.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4DAC68 | 13504 bytes |
SHA-256: b2e954624b62ea9662557dddda532f8c4e554172dbbbf07339f41bae93f52006 |
|||
font_06_sfnt_off004e31ca.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4E31CA | 7004 bytes |
SHA-256: 67390144ffc63d992b1fb8bbe92cae0e5f975fec1271538936c2060c6f7807b2 |
|||
font_07_sfnt_off004e4ac0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4E4AC0 | 33092 bytes |
SHA-256: 6a7b0dd5309c27d11ce680f302b1d3bccf51ecec1dfd09a4dac313c9f19b271a |
|||
font_08_sfnt_off004ead5e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4EAD5E | 13916 bytes |
SHA-256: 366161cd4bf8b0a4ef2a8848dc7214de742574b7c4da186ef81c176da0961d0a |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.