Malicious PDF — malware analysis report

Static analysis result for SHA-256 1e61989736bd6a7b…

MALICIOUS

PDF

360.2 KB Created: 2015-08-24 00:39:10 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: a683c3b36a73cd4cff4c132183bfbf03 SHA-1: 94cb2cc1fa6f86bd27a2a79d67af0faf62179b75 SHA-256: 1e61989736bd6a7b1cc4eec68e431e4a97bbb4959495fe9eeb31beea5b6fdbec
98 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.002 Spearphishing Attachment

The PDF contains embedded JavaScript and a critical heuristic firing for a malicious redirector link. The redirector URL is `http://botcraftman.ru/?lip&keyword=Crysis+3+directx+10+patch+%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C&charset=utf-8`, which is likely intended to lead the user to a malicious site. The ML classifier also flagged this PDF with high confidence. No specific malware family could be identified.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=Crysis+3+directx+10+patch+%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C&charset=utf-8
    • http://img0.liveinternet.ru/images/attach/c/6//4694/4694265_zayavlenie__na__poluchenie_.pdf
    • http://img1.liveinternet.ru/images/attach/c/6//4693/4693105_prodigy__skachat__vse_.pdf
    • http://img1.liveinternet.ru/images/attach/c/6//4693/4693213_suynuy__anarhii__2_.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000553ff.bin
7e78483676646dc93163efc92db1d7be671242a84190962636e168aa03203217		 pdf-font-stream PDF embedded font (sfnt) at offset 0x553FF 10232 bytes
font_01_sfnt_off0005706b.bin
ba757eb888a3d028d9e3d27be1e4805c1b551326a434ccb0b917f070fc26693a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5706B 16452 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.