Malicious PDF — malware analysis report

Static analysis result for SHA-256 31273b8140975f9a…

MALICIOUS

PDF

355.3 KB Created: 2015-08-27 09:53:17 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: 6edf5b503de42b98b07049ef9af8c2e2 SHA-1: 74c83785521125839183ab197376a25b1813c093 SHA-256: 31273b8140975f9a3f767143d1c38feffe160c1712ea924f486954b5ffd30459
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains an embedded link that is flagged as a malicious redirector. This link, http://botcraftman.ru/?lip&keyword=%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+winlocker+builder+v06&charset=utf-8, likely serves to download or redirect the user to a secondary malicious payload. The document body content is heavily obfuscated and unreadable, but the presence of the malicious link is a strong indicator of malicious intent.

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+winlocker+builder+v06&charset=utf-8
    • http://img1.liveinternet.ru/images/attach/c/7//4771/4771812_black__market__skachat_.pdf
    • http://img1.liveinternet.ru/images/attach/c/7//4771/4771937_burevoy__oderzhimuyy_.pdf
    • http://img0.liveinternet.ru/images/attach/c/7//4772/4772017_nokia__5530__xpressmusic_.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00053c80.bin
c27f9a76ae573b6bcb7861114fc9917b5c966bf996f588c263ea08b7a41a2d17		 pdf-font-stream PDF embedded font (sfnt) at offset 0x53C80 10268 bytes
font_01_sfnt_off00055984.bin
2cc8ae7f93f7fadfff915822050cf8494e03ae14b8782cbd7213831ccbdf6ba8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x55984 17704 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.