Malicious PDF — malware analysis report

Static analysis result for SHA-256 140dd413ee7b97a8…

MALICIOUS

PDF

354.7 KB Created: 2015-08-24 00:19:00 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: c7ace2910452d7356d327d0279c98c14 SHA-1: 4d3b6a02ad6c75787d037c3f62414d9cca592efb SHA-256: 140dd413ee7b97a8270d946a0ca3189053e5b2853d222d66e8c40e2224c5514b
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a malicious redirector link that attempts to lure users into downloading potentially harmful content by disguising it as a Flash Player update. The ML classifier also flagged this PDF with high confidence. No scripts were extracted, but the embedded URL is the primary indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=No+flash+%D0%B4%D0%BB%D1%8F+css+v34+%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C&charset=utf-8
    • http://img0.liveinternet.ru/images/attach/c/6//4694/4694230_skachat__windows__7_.pdf
    • http://img1.liveinternet.ru/images/attach/c/6//4693/4693199_video__master__skachat_.pdf
    • http://img1.liveinternet.ru/images/attach/c/6//4693/4693672_skachat__igru__maynkraft_.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000544a7.bin
d54d0dfddb2fab18da059a19cbaf7bd41f6ceb7e40538d92f12bc0f5724ead49		 pdf-font-stream PDF embedded font (sfnt) at offset 0x544A7 8612 bytes
font_01_sfnt_off00055ccf.bin
f4dc75d3f53c3675722e5a6aa6d2c0a66a43930f75d34d70be4bc1cb2e27fa8d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x55CCF 15324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.