Malicious PDF — malware analysis report

Static analysis result for SHA-256 0d3ed48144101a5a…

MALICIOUS

PDF

186.3 KB Created: 2015-07-23 21:24:30 +03:00 Authoring application: wkhtmltopdf 0.12.2.1 (via Qt 4.8.6)
MD5: 6e52b9d95e5321e04fc600dfd56b06a2 SHA-1: ecaa5b21723d05cd8fa08ab7fcc250a7d3dab419 SHA-256: 0d3ed48144101a5a54d02544da8cdab32a4fcdd0437855f315ba9c344400bc6b
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a critical heuristic firing indicating a link to known malicious redirector infrastructure. The embedded URL 'http://botcraftman.ru/...' is highly suspicious and likely serves as a lure to a malicious site. While no scripts were explicitly extracted, the PDF structure and the malicious URL suggest an attempt to trick the user into downloading further malicious content or providing sensitive information.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9982

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+%D0%BC%D1%83%D0%BB%D1%8C%D1%82%D0%B8%D0%BA+%D1%81%D0%BF%D0%B0%D0%BD%D1%87+%D0%B1%D0%BE%D0%B1+8+%D1%81%D0%B5%D0%B7%D0%BE%D0%BD+%D1%87%D0%B5%D1%80%D0%B5%D0%B7+%D1%82%D0%BE%D1%80%D1%80%D0%B5%D0%BD%D1%82&charset=utf-8
    • http://fastpic.ru/
    • http://www.liveinternet.ru/click
    • http://img0.liveinternet.ru/images/attach/c/5//4184/4184765_skachat_sims_3_sverhestestvennoe_cherez_torrent.pdf
    • http://img0.liveinternet.ru/images/attach/c/5//4184/4184815_1s_predpriyatie_82_konfiguraciya_torgovlya_i_sklad_torrent.pdf
    • http://img0.liveinternet.ru/images/attach/c/5//4184/4184752_dnevnik_po_uchebnoy_praktike_v_otdele_doznaniya.pdf
    • http://www.microsoft.com/typography/fonts/
    • http://www.microsoft.com/typography/fonts/You

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002450d.bin
880e53e6f12106514012eaabb19a261b9f8ae03d695445fc59a5b9b5a1293281		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2450D 3556 bytes
font_01_sfnt_off00025290.bin
c68eb569a89b8bcdb15df3332192a846cb344b5d2c9a671064bac83c9f56b5fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x25290 14696 bytes
font_02_sfnt_off0002807b.bin
d5d8a66c54d88b1fd3e9751d1946ec7768e13949c664bd33b207189c6d131484		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2807B 14468 bytes
font_03_sfnt_off0002ab2e.bin
094c7321dcc955bd559616a4acd9af8b75b8648626594ea18845c87f2c769310		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2AB2E 6976 bytes
font_04_sfnt_off0002bf74.bin
819f9cc5156bfe3dae03045446d677a19b5879270357875344f9514601da73e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2BF74 6084 bytes
font_05_sfnt_off0002cf09.bin
9364d8c42993f0db1eb41a63b15a48dd56cef5056a611ab8e91dd81183a5a95e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2CF09 3752 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.