Malicious PDF — malware analysis report

Static analysis result for SHA-256 5107858d2fbda1a5…

MALICIOUS

PDF

358.3 KB Created: 2015-08-26 18:48:50 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: 3c11ae26b30c11c9098f7b6d7ce71d7a SHA-1: 0fec08ad73eb1c642123ea8ea916c25e79d8dc32 SHA-256: 5107858d2fbda1a5155cc487e9fa65e520b7f9fa7a26fc3969625c3e0f3adb57
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a heuristic firing for a malicious redirector link pointing to botcraftman.ru. This indicates the document's primary purpose is to lure the user to a potentially harmful site. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the exact lure.

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=navteq+2015++shturmann&charset=utf-8
    • http://img0.liveinternet.ru/images/attach/c/7//4762/4762191_skachat__model__nozha_.pdf
    • http://img0.liveinternet.ru/images/attach/c/7//4762/4762151_kugaenko__elena__kniga_.pdf
    • http://img0.liveinternet.ru/images/attach/c/7//4762/4762216_kak__podnyat__statistiku_.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00054cdf.bin
05ad2de0d79425f28ce46e7c2ad1fc3db88d1db220e777f94a5288065575809a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x54CDF 9440 bytes
font_01_sfnt_off000567a6.bin
5733e7a894f288168860cbc49129e2ed350e77c9773442e2ca0ee1dfe70f44c7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x567A6 16256 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.