Malicious PDF — malware analysis report

Static analysis result for SHA-256 4520e0aefb37eaef…

MALICIOUS

PDF

376.2 KB Created: 2015-08-24 00:24:01 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6) First seen: 2021-11-20
MD5: 51f6844dd6e2c21c50120ae45ff02530 SHA-1: 29321f7cd0a1555637b92eaf9d2684af9cac352e SHA-256: 4520e0aefb37eaef6ef96d5d9d8427724e96ed0db0793f69a8f3d84af34d10f7
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains an embedded link that redirects to a known malicious domain, disguised with keywords related to game downloads. This indicates an attempt to trick users into visiting a malicious site, likely for phishing or to download further malware. No scripts were extracted, but the embedded URL is a high-confidence indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9946

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=final+fantasy+13+%D0%BD%D0%B0+pc+%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+%D1%82%D0%BE%D1%80%D1%80%D0%B5%D0%BD%D1%82+%D1%80%D1%83%D1%81%D1%81%D0%BA%D0%B0%D1%8F+%D0%B2%D0%B5%D1%80%D1%81%D0%B8%D1%8F&charset=utf-8 In PDF document text
    • http://img0.liveinternet.ru/images/attach/c/6//4694/4694281_gta__san__andreas_.pdfIn PDF document text
    • http://img1.liveinternet.ru/images/attach/c/6//4693/4693385_kakie__drayvera__nuzhnuy_.pdfIn PDF document text
    • http://img0.liveinternet.ru/images/attach/c/6//4694/4694196_yemulyator__ps3__dlya_.pdfIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00059c62.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x59C62 9020 bytes
SHA-256: 42f3b1e7407c0eb72f45d619aae98f1dd6ce1bc9292b26e0fb164f5a2ef8b0cb
font_01_sfnt_off0005b4ee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5B4EE 14408 bytes
SHA-256: 26888df506de6f3eeac5ed302cf3c4b5c446ae46bb2895dc9375c3b1eb8fbd6e

Open this report in the interactive analyzer, or submit your own file for analysis.