Malicious PDF — malware analysis report

Static analysis result for SHA-256 4b5864d1fefe605e…

MALICIOUS

PDF

351.8 KB Created: 2015-08-28 13:38:22 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: 85f89154c11fbcf0d83bd2917de854cc SHA-1: b8f61503a0d9746e8d216bdd3265f09598b9893e SHA-256: 4b5864d1fefe605e9f668af11cefb8a5afffb9b3db7e518115e13b72e9437651
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged for containing a link to a known malicious redirector. This indicates the file's primary purpose is to lure users to a potentially harmful website. The embedded URL, http://botcraftman.ru/..., is the most critical indicator of compromise. No scripts were extracted from this sample, and the document body was heavily obfuscated.

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+%D0%BF%D1%80%D0%BE%D0%B3%D1%80%D0%B0%D0%BC%D0%BC%D1%83+%D0%BD%D0%B0+%D0%B0%D0%BD%D0%B4%D1%80%D0%BE%D0%B8%D0%B4+%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE+40+%D0%B2%D0%B8%D1%80%D1%82%D1%83%D0%B0%D0%BB%D1%8C%D0%BD%D0%B0%D1%8F+%D1%81%D0%B8%D0%B3%D0%B0%D1%80%D0%B5%D1%82%D0%B0&charset=utf-8
    • http://img1.liveinternet.ru/images/attach/c/7//4803/4803768_skachat__igru__alesha_.pdf
    • http://img1.liveinternet.ru/images/attach/c/7//4803/4803130_skachat__novuyy__albom_.pdf
    • http://img0.liveinternet.ru/images/attach/c/7//4802/4802824_skachat__besplatno__navigator_.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00053b4c.bin
7737e4b8ca6d5d2cecad836398dea2884f78972effb6af7912ca7025a958e0d6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x53B4C 8020 bytes
font_01_sfnt_off000552ef.bin
572c3819ece2185be95ec98d3dcd07843e81147484b9d9a49ae46add7fea5650		 pdf-font-stream PDF embedded font (sfnt) at offset 0x552EF 13852 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.