PDF malware analysis — malicious · fe65b4741c995da9

MALICIOUS

PDF

4.96 MB

MD5: 1e3a8742da91fb711ab299b5f3211c9e SHA-1: d84238a852afe4ae452ada75fbffb0a1f4aeee8c SHA-256: fe65b4741c995da94ae45585117a59a0675a7a8c47b85c466ba31d0ad44e8039

68 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The critical heuristic PDF_REPEATED_PAYLOAD_LINK_LURE indicates that the PDF contains multiple invisible links designed to trick the user into downloading a payload. The extracted URL http://www.gks.ru/free_doc/doc_2016/bul_dr/mun_obr2016.rar is identified as the target of these links, suggesting a delivery mechanism for a malicious archive. The PDF_URI heuristic also points to an external PDF, potentially for further obfuscation or as part of the lure.

Machine Learning

Nyx PDF Classifier clean score 0.0084

Heuristics 3

Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE

PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
External URI low PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://www.dataplus.ru
- https://www.avtodispetcher.ru/distance/
- http://www.communitywalk.com/ugra
- http://hmao.kaisa.ru/object/1808728563?lc=ru
- http://www.boxinghmao.ru
- http://www.muzgeo.ru
- http://www.ugramegasport.ru
- http://www.shc-ugra.ru
- http://www.ugrasport.com
- http://ecofest-ugra.ru/
- http://www.zapoved.net/images/maps/KhantyMansiiskii.gif
- http://86q.ru/imag/karta.gif
- http://xn--80aahfjo8abu2l.xn--p1ai/manyfaces/staff/
- http://www.samotlorfest.ru/rasp.php
- http://ugrales.ru/files/prezent/2017/Itogi_2016.pptx
- http://ugrales.ru/files/itogy_goda/2015/otchet_o_razvit_sfery_turizma_2015.pdf
- http://www.adm.ugorsk.ru/news/26372/
- http://iknugra.ru/istoriko-kulturnoe-nasledie-yugri/dostoprimechatelnie-mesta/barsova-gora/
- http://xn--80aafdjbbvz3abujk7c0k.xn--p1ai/?page_id=1009
- http://www.journal-discussion.ru/publication.php?id=1500
- http://www.vizitugra.ru/nvtur.html#description_1072
- http://stariy-surgut.ru/turistsko-informatsionnyy-tsentr/kulturno-poznavatelnyy-turizm/
- http://www.dumahmao.ru/ai_fill/File/MSU/InfmethodCollect/Infometodcollect_17_2015_zas_al.pdf
- http://iknugra.ru/istoriko-kulturnoe-nasledie-yugri/
- http://www.dzhmao.ru/info/perechen-sanatorno-kuro.php
- http://ugraoopt.ru/istoriya-zapovednogo-otdela/istoriya-razvitiya-osobo-okhranyaemykh-prirodnykh-territoriy-khanty-mansiyskogo-avtonomnogo-okruga-yu/
- http://ns.adobe.com/xap/1.0/
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/sType/ResourceRef#
- http://www.gks.ru/free_doc/new_site/perepis2010/croc/Documents/Vol1/pub-01-03.pdf
- http://www.gks.ru/free_doc/doc_2016/bul_dr/mun_obr2016.rar
- https://2gis.ru/nizhnevartovsk
- http://www.tourism.admhmao.ru/upload/iblock/5b1/kasatkin_ozherele_yugry.pdf
- http://uralfo.gov.ru/district/
- http://admtyumen.ru/images/upload/oblast.gif
- http://docs.cntd.ru/document/429018536
- http://www.admhmao.ru/upload/iblock/7a9/aktualnaya_versiya_postanovleniya_418_p_dekabr_2015_.docx
- http://www.depprirod.admhmao.ru/razvitie-konkurentsii-v-yugre/114727/informatsiya-o-sostoyanii-i-razvitiya-konkurentnoy-sredy-na-rynke-turistskikh-uslug-za-2015-god
- http://www.admhmao.ru/dokumenty/proekty-pravitelstva/documents.php?sid=55037&bid=740&pid=&eid=386829
- http://www.tourism.admhmao.ru/upload/iblock/638/_istoki_katalog_2015_s_izmeneniyami.doc
- https://www.google.ru/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0ahUKEwix2af82Y_TAhWGKJoKHZYACDoQFggcMAA&url=http%253A%252F%252Fwww.russiatourism.ru%252Fdata%252FFile%252Fnews_file%252F2012%252FReshikova_etnotourism.ppt&usg=AFQjCNFhnDg2b6BEoUtRyeYOxRIsS4bGRw&sig2=djt75fyizvrC3jw4d7WwQA&bvm=bv.151426398,d.bGg
- http://www.gks.ru/free_doc/new_site/perepis2010/croc/Documents/Vol4/pub-04-04.pdf
- http://www.admhmao.ru/bitrix/redirect.php?event1=file&event2=download&event3=44_p.doc&goto=/upload/iblock/8f4/44_p.doc
- http://www.tourism.admhmao.ru/vse-novosti/610042/
- http://www.tourism.admhmao.ru/vse-novosti/748349/
- https://vk.com/numi_torum
- http://www.tourism.admhmao.ru/turizm-v-yugre/reestr-turistskikh-marshrutov-turov-i-ekskursionnykh-programm/723901/reestr-ekologicheskikh-trop-turov-i-marshrutov-khanty-mansiyskogo-avtonomnogo-okruga-yugry
- http://www.admhmao.ru/upload/iblock/f53/poyasnitelnaya-zapiska.docx
- http://docs.cntd.ru/document/411709517
+1 more URL(s)

Extracted artifacts 15

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_083_off00095410.bin` `b4e5257a34dbcc07f7fc454e62f6a4b7e4409666df8cfeda03d8fe9f0cfd5060`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x95410	543000 bytes
`stream_090_off000e2a41.bin` `8450aadff05bf6b68d36a9ba51fc5b63f942909e259747ce0ccafedd6d5114ce`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xE2A41	4194304 bytes
`stream_092_off000fd8fa.bin` `ec91cad51ca49cc2f8dd35944eaf400d464d23f8183477d44f6015be1a689460`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xFD8FA	1437240 bytes
`stream_094_off0018c068.bin` `98f91b479d447f67dfb5a96edb3331d685efe39ca270b17693ac07c205f9b372`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x18C068	1216152 bytes
`stream_100_off004dd6b8.bin` `a39657c03c0145c86ec3fd9b0e25a62a92ed29494fed95d4365609d3ec065097`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4DD6B8	31268 bytes
`icc_00_off000008f9.icc` `ee2f821d16d12ec9e9f2958ac8865f40912d0ce1fb9625a31b594fab942b1caf`	pdf-icc-profile	PDF ICC profile at offset 0x8F9	4456 bytes
`icc_01_off000016c1.icc` `2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e`	pdf-icc-profile	PDF ICC profile at offset 0x16C1	3144 bytes
`font_00_sfnt_off004c7e92.bin` `b3f078f1ebbd7d8261c37b1b5a0fb3686d06b4626562ce161abf2927009bfe51`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4C7E92	51536 bytes
`font_01_sfnt_off004d18ed.bin` `d569259459ef5292c6de1c38876f9261e6201570f8fc4cc6f1bfa43e76d7251f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4D18ED	39336 bytes
`font_02_sfnt_off004d8b57.bin` `179c25569bb08ef85882d56d933f83a4f4ed9bd8c73251f4c74b9739f498fba4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4D8B57	8932 bytes
`font_03_sfnt_off004da009.bin` `f6258bdbd37f692ce67cabd76c005d2c0c3d33cd728838415b174868fbef7e14`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4DA009	3968 bytes
`font_04_sfnt_off004dac68.bin` `b2e954624b62ea9662557dddda532f8c4e554172dbbbf07339f41bae93f52006`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4DAC68	13504 bytes
`font_06_sfnt_off004e31ca.bin` `67390144ffc63d992b1fb8bbe92cae0e5f975fec1271538936c2060c6f7807b2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4E31CA	7004 bytes
`font_07_sfnt_off004e4ac0.bin` `6a7b0dd5309c27d11ce680f302b1d3bccf51ecec1dfd09a4dac313c9f19b271a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4E4AC0	33092 bytes
`font_08_sfnt_off004ead5e.bin` `366161cd4bf8b0a4ef2a8848dc7214de742574b7c4da186ef81c176da0961d0a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4EAD5E	13916 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.