Malicious PDF — malware analysis report

Static analysis result for SHA-256 50896af90fe69627…

MALICIOUS

PDF

299.4 KB Created: 2015-08-29 11:20:09 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6) First seen: 2021-11-24
MD5: b1263e1beea3791766d6105a76b406ce SHA-1: 3082992737505ad851db861f3eba8bfd97775c23 SHA-256: 50896af90fe69627e11b2e06bcd383e7a2c537c1141d681659c78fda62e82a3e
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged as malicious by a machine learning classifier and contains an embedded JavaScript stream. Crucially, it includes a link to known malicious redirector infrastructure at http://botcraftman.ru/. This suggests the document is intended to redirect users to a malicious site, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7618

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=unturned+30&charset=utf-8 In PDF document text
    • http://img1.liveinternet.ru/images/attach/c/7//4829/4829859_skachat__mod__na_.pdfIn PDF document text
    • http://img1.liveinternet.ru/images/attach/c/7//4829/4829896_forma__po__knd_.pdfIn PDF document text
    • http://img1.liveinternet.ru/images/attach/c/7//4829/4829989_simulyator__bezdorozhya__na_.pdfIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0004630d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4630D 8512 bytes
SHA-256: d37ce7e3d8d5440d939b6e1dc42d20af3f6ab3046274b902dc7a6c9a429f4c9d
font_01_sfnt_off00047b98.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x47B98 16276 bytes
SHA-256: af5a0233dc3f120c77bd36f03a2adbb2591c663f8c9b8cfd2802f699b3404fcc

Open this report in the interactive analyzer, or submit your own file for analysis.