Malicious PDF — malware analysis report

Static analysis result for SHA-256 52163dddb7617ab1…

MALICIOUS

PDF

363.1 KB Created: 2015-08-21 09:22:32 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: a871751c5db6231f9b92c50dcc6265fa SHA-1: 5c28aa358ad68cb47e9558b01bc7f8a4fb141c2d SHA-256: 52163dddb7617ab15b47576cbf232245872ca265ce0281f45a6b573db980e01a
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by a critical heuristic for containing a link to known malicious redirector infrastructure. The ML classifier also assigned a high probability of maliciousness. The embedded URL points to botcraftman.ru, which is associated with malicious activity. No scripts were extracted, but the presence of a malicious redirector link strongly suggests an attempt to lure the user to a harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9978

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+%D0%BC%D0%B0%D0%B9%D0%BD%D0%BA%D1%80%D0%B0%D1%84%D1%82+%D0%BD%D0%B0+%D0%B0%D0%BD%D0%B4%D1%80%D0%BE%D0%B8%D0%B4+236&charset=utf-8
    • http://img0.liveinternet.ru/images/attach/c/6//4654/4654675_dnevniki_vampira_10_kniga_ohotniki_obretaya_sudbu_skachat.pdf
    • http://img0.liveinternet.ru/images/attach/c/6//4654/4654731_igra_rao_rao_2_skachat_besplatno.pdf
    • http://img0.liveinternet.ru/images/attach/c/6//4654/4654744_skachat_mod_tropik_kraft_na_maynkraft_152.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0005688f.bin
9f0f0a1f1fa281c7255f1f6d21a555a5b47ae3a6503a3336be27d993011a707c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5688F 8856 bytes
font_01_sfnt_off00058229.bin
fbdaec719e850d2f75394971743aea195167cae23fd4141a6a1fa6ee1b7df679		 pdf-font-stream PDF embedded font (sfnt) at offset 0x58229 13240 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.