Malicious PDF — malware analysis report

Static analysis result for SHA-256 532271ca119acaef…

MALICIOUS

PDF

186.2 KB Created: 2015-08-08 15:12:42 +03:00 Authoring application: wkhtmltopdf 0.12.2.1 (via Qt 4.8.6) First seen: 2021-09-13
MD5: 47b3608d62980411dfdf6b41ecb2b262 SHA-1: 9aea2c98692b2921fef9dbfd259df1f0a0b908f9 SHA-256: 532271ca119acaefca9390e8cccd548742f4808ccdfbf8fe6796209c06d53e73
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded links that redirect to a known malicious domain, botcraftman.ru, masquerading as a free download lure. The ML classifier strongly indicates maliciousness. While no scripts were directly extracted, the PDF structure and embedded links suggest an attempt to lure users to malicious infrastructure, likely for further exploitation or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9982

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D0%93%D0%BE%D0%B2%D0%BE%D1%80%D1%8F%D1%89%D0%B8%D0%B9+%D0%BA%D0%BE%D1%82+%D1%82%D0%BE%D0%BC+%D0%BD%D0%B0+%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD+%D0%BD%D0%BE%D0%BA%D0%B8%D0%B0+%D1%81+5+06&charset=utf-8 In PDF document text
    • http://fastpic.ru/In PDF document text
    • http://www.liveinternet.ru/clickIn PDF document text
    • http://img0.liveinternet.ru/images/attach/c/5//4240/4240875_aleksey_bryancev_skachat_albom_besplatno_torrent.pdfIn PDF document text
    • http://img0.liveinternet.ru/images/attach/c/6//4388/4388160_skachat_knigu_aleksey_ivanov_hrebet_rossii_torrent.pdfIn PDF document text
    • http://img0.liveinternet.ru/images/attach/c/6//4392/4392080_xiii_igra_skachat_torrent.pdfIn PDF document text
    • http://www.microsoft.com/typography/fonts/In PDF document text
    • http://www.microsoft.com/typography/fonts/YouIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00024494.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x24494 3556 bytes
SHA-256: 880e53e6f12106514012eaabb19a261b9f8ae03d695445fc59a5b9b5a1293281
font_01_sfnt_off00025217.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x25217 14260 bytes
SHA-256: 20c457be7473a5a4e4e4168c99132f3cc3449fca93fad1d12d475c1fbe919751
font_02_sfnt_off00027f26.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x27F26 14640 bytes
SHA-256: f17bdb7f3f1868c70b6fd654539a78a3e037a7a335eaa5e7f7310978e682fe34
font_03_sfnt_off0002aa5a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2AA5A 7072 bytes
SHA-256: 0168535160593e54ff5194809f95453beed76c5e1d99f2526918c5218f7f72fd
font_04_sfnt_off0002bed2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2BED2 6084 bytes
SHA-256: 819f9cc5156bfe3dae03045446d677a19b5879270357875344f9514601da73e3
font_05_sfnt_off0002ce67.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2CE67 3752 bytes
SHA-256: 9364d8c42993f0db1eb41a63b15a48dd56cef5056a611ab8e91dd81183a5a95e

Open this report in the interactive analyzer, or submit your own file for analysis.