Malicious PDF — malware analysis report

Static analysis result for SHA-256 26950eb7e8973658…

MALICIOUS

PDF

184.4 KB Created: 2015-08-05 13:28:05 +03:00 Authoring application: wkhtmltopdf 0.12.2.1 (via Qt 4.8.6)
MD5: a98509c90ad5a7f4b6a7c13fab834335 SHA-1: 7fb19b0514682cf65d66ce50f8526bfa842bf7e5 SHA-256: 26950eb7e8973658ea65b68eb191f9d3d770096709fb9a7a08ddb78ec15aaf8b
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF was flagged by a critical heuristic for linking to known malicious redirector infrastructure. The ML classifier also strongly indicated maliciousness. The embedded URL http://botcraftman.ru/ is identified as a malicious redirector, suggesting the document's purpose is to lure users to a harmful site. No scripts were extracted, and the document body was not parsable.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9982

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=Genius+easypen+i405x+%D0%B4%D1%80%D0%B0%D0%B9%D0%B2%D0%B5%D1%80&charset=utf-8
    • http://fastpic.ru/
    • http://www.liveinternet.ru/click
    • http://img0.liveinternet.ru/images/attach/c/6//4304/4304446_mikimaus_onlayn_smotret_besplatno_vse_serii_podryad_na_russkom.pdf
    • http://img0.liveinternet.ru/images/attach/c/6//4304/4304525_raspisanie_avtobusov_ufa_cheboksaruy.pdf
    • http://img0.liveinternet.ru/images/attach/c/6//4304/4304501_stalker_zov_pripyati_mod_na_oruzhie.pdf

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_048_off0002a35c.bin
22033c3859069753a41ef5c4c83b68bbb2d2a4647e95a850376e1821f4564400		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2A35C 7036 bytes
font_00_sfnt_off00023af3.bin
880e53e6f12106514012eaabb19a261b9f8ae03d695445fc59a5b9b5a1293281		 pdf-font-stream PDF embedded font (sfnt) at offset 0x23AF3 3556 bytes
font_01_sfnt_off00024876.bin
f17de9f07cfd6a48d7073ff9f7827b895aa2eb85fb9f4b107dc62930d053cda7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x24876 15296 bytes
font_02_sfnt_off00027770.bin
bdf5e847e4de365d41ccce3b9498996cd0218e089c95e7a2a68c0e4e0ae13eb5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x27770 14856 bytes
font_04_sfnt_off0002b7bb.bin
819f9cc5156bfe3dae03045446d677a19b5879270357875344f9514601da73e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2B7BB 6084 bytes
font_05_sfnt_off0002c750.bin
9364d8c42993f0db1eb41a63b15a48dd56cef5056a611ab8e91dd81183a5a95e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2C750 3752 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.