PDF malware analysis — malicious · 534d91057a4ff92d

MALICIOUS

PDF

295.8 KB Created: 2015-08-22 08:54:05 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)

MD5: 5505e71da03232ebc33215b77acff911 SHA-1: b65ce74ec4b48cc9b3e5e9f98ee17716ce94d017 SHA-256: 534d91057a4ff92d37930ef3ff3695232e6e58328c4112d3fe9052c370873bee

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing indicating a redirector link to a known malicious domain. The embedded URL 'http://botcraftman.ru/?lip&keyword=apachiiskyhair_v_1_5_full+%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C&charset=utf-8' is the primary indicator of malicious intent. This suggests the PDF is designed to lure users to a compromised or malicious site. No scripts were extracted, limiting further analysis of the payload.

Heuristics 2

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://botcraftman.ru/?lip&keyword=apachiiskyhair_v_1_5_full+%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C&charset=utf-8
- http://img0.liveinternet.ru/images/attach/c/6//4674/4674466_prostuye_notuy_dlya_sintezatora_dlya_nachinayuschih.pdf
- http://img0.liveinternet.ru/images/attach/c/6//4674/4674459_skachat_zumu_besplatno_na_kompyuter_bez_ogranicheniya_vremeni.pdf
- http://img0.liveinternet.ru/images/attach/c/6//4674/4674503_allj_yeldzhey_skachat_albom_torrent.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00045175.bin` `75ccfd20df74b41059b7774d96d328531f1e93311332929b1b56405f1e770a78`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x45175	9932 bytes
`font_01_sfnt_off00046ca7.bin` `9635ef3634364da45b217a9a395c2822238d8c505c33ce2d0e876033e745ab73`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x46CA7	17448 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.