Malicious PDF — malware analysis report

Static analysis result for SHA-256 24d407900964d4d6…

MALICIOUS

PDF

354.5 KB Created: 2015-08-29 12:45:58 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6) First seen: 2021-07-07
MD5: f36dc9fe2c9d5e90e60c6b2951a0101a SHA-1: db24460acd06410689522f3df4cb341134e02ad0 SHA-256: 24d407900964d4d6b1befbf4e2ba22152e86b8aa762fdf8373001fe6c7e487c9
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a link to a known malicious redirector, indicating an attempt to lure the user to a harmful site. While no scripts were explicitly extracted, the PDF structure and the malicious URL strongly suggest an intent to compromise the user through redirection. The ML classifier also flagged this PDF with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+%D0%BF%D0%B5%D1%81%D0%BD%D0%B8+vnuk&charset=utf-8 In PDF document text
    • http://img1.liveinternet.ru/images/attach/c/7//4831/4831053_skachat__quickbinder__dlya_.pdfIn PDF document text
    • http://img1.liveinternet.ru/images/attach/c/7//4831/4831166_shablon__trudovogo__dogovora_.pdfIn PDF document text
    • http://img1.liveinternet.ru/images/attach/c/7//4829/4829887_skachat__minecraft__181_.pdfIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000539c5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x539C5 9212 bytes
SHA-256: a86d38f30a2ff6369781667e170161b3bb076f29c55244fff0844b369e4b609b
font_01_sfnt_off000553ab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x553AB 18324 bytes
SHA-256: d98338f84c492a2540e111287e464564b3a905843ae48ef894ca13b04468a9c2

Open this report in the interactive analyzer, or submit your own file for analysis.