Malicious PDF — malware analysis report

Static analysis result for SHA-256 04b3667f59b2f3f1…

MALICIOUS

PDF

349.1 KB Created: 2015-08-22 12:17:05 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: 4fc23ef9b386709847304a3ae70fb71a SHA-1: 424a359a913ea5fb2f0d655cad46c9ffa3acbb60 SHA-256: 04b3667f59b2f3f103b817d77979c3fc93fae42b9196ba9fb4d7864442404244
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains an embedded link to a known malicious redirector, http://botcraftman.ru/, which is a strong indicator of malicious intent. The ML classifier also flagged this PDF with high confidence. While no scripts were extracted, the presence of a malicious URL suggests the document is designed to lure the user to a compromised site, likely for further exploitation or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9963

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+%D0%B0%D0%B2%D0%B0%D1%81%D1%82+%D1%81+%D0%B2%D0%B5%D1%87%D0%BD%D1%8B%D0%BC+%D0%BA%D0%BB%D1%8E%D1%87%D0%BE%D0%BC&charset=utf-8
    • http://img1.liveinternet.ru/images/attach/c/6//4675/4675224_drayver_dlya_veb_kameruy_dell_inspiron_n5110.pdf
    • http://img1.liveinternet.ru/images/attach/c/6//4675/4675101_uill_bouyen_mir_bez_zhalob_skachat_besplatno_txt.pdf
    • http://img1.liveinternet.ru/images/attach/c/6//4675/4675959_ct_po_geografii_2015.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00053504.bin
88e52bf7a206363fa572b35c289b18284eb36b1b858302efc80e73026b759790		 pdf-font-stream PDF embedded font (sfnt) at offset 0x53504 7224 bytes
font_01_sfnt_off000549cd.bin
23f94d02cdcddca614334dc8bc1663f04578947e259bc8d68e2a3658bc58fb09		 pdf-font-stream PDF embedded font (sfnt) at offset 0x549CD 13660 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.