Malicious PDF — malware analysis report

Static analysis result for SHA-256 1971e06f3e89a37a…

MALICIOUS

PDF

364.2 KB Created: 2015-08-20 07:21:40 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: d1e6e8d2eafbb52be0e781c2c399ee02 SHA-1: 447ecf63d0ffea4818f525e31d8095c12ddf37c0 SHA-256: 1971e06f3e89a37adf5b45277e152a5894b3326a2a71115db75d15ba87a4a63e
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by multiple heuristics, including a critical alert for a malicious redirector link. The embedded URL `http://botcraftman.ru/...` is identified as a known malicious redirector. This suggests the document's primary purpose is to lure the user to a malicious website, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9979

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Dropper.Agent-7622239-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7622239-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D0%A1%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+%D0%BC%D0%B0%D0%B9%D0%BD%D0%BA%D1%80%D0%B0%D1%84%D1%82+152+%D1%81+%D0%BC%D0%BE%D0%B4%D0%B0%D0%BC%D0%B8+%D1%87%D0%B5%D1%80%D0%B5%D0%B7+zona&charset=utf-8
    • http://img0.liveinternet.ru/images/attach/c/6//4638/4638840_neposredstvenno_kaha_1_sezon_vse_serii_skachat_torrent.pdf
    • http://img0.liveinternet.ru/images/attach/c/6//4638/4638791_mt65xx_preloader_skachat.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0005675c.bin
677d1721fdff38fb99997f69df046aa8ab3b0346b9483ae093337f6ba2aadd63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5675C 10100 bytes
font_01_sfnt_off00058440.bin
cee0fd61970de6907c24d5c1d304447f9fb71eed9643e0334aea17c202fdbc87		 pdf-font-stream PDF embedded font (sfnt) at offset 0x58440 14928 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.