Malicious PDF — malware analysis report

Static analysis result for SHA-256 59474c2ed8234c9c…

MALICIOUS

PDF

367.5 KB Created: 2015-08-19 16:10:22 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: 92506af56f15b05aa1380ea4823e5759 SHA-1: 5117f41f2bfcff64ef6801f98d653a3caba5f631 SHA-256: 59474c2ed8234c9cd72891a0fba76b0099a809caba05cda6fff95f72d9e587ef
122 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains multiple links advertising cracked software, with one link identified as a known malicious redirector. The ML classifier strongly indicates maliciousness. While no scripts were explicitly extracted, the presence of embedded URLs and the nature of the lures suggest an attempt to redirect the user to malicious infrastructure, likely for further payload delivery or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D1%81%D1%86%D0%B5%D0%BD%D0%B0%D1%80%D0%B8%D0%B9+%D0%B8%D0%B3%D1%80%D1%8B+%D0%BF%D0%BE+%D1%81%D1%82%D0%B0%D0%BD%D1%86%D0%B8%D1%8F%D0%BC+%D0%B4%D0%BB%D1%8F+%D0%BB%D0%B0%D0%B3%D0%B5%D1%80%D1%8F&charset=utf-8
    • http://img0.liveinternet.ru/images/attach/c/6//4626/4626567_propellerhead_reason_7_skachat_torrent.pdf
    • http://img1.liveinternet.ru/images/attach/c/6//4627/4627731_fifa_15_skachat_torrent_pc_repack_ot_mehanikov.pdf
    • http://img1.liveinternet.ru/images/attach/c/6//4627/4627278_skachat_word_2014_besplatno_cherez_torrent.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00056f05.bin
007c2bf8b1cdcce4e255de22b176ac929744f70426ba62912326f5d83ecd5599		 pdf-font-stream PDF embedded font (sfnt) at offset 0x56F05 8952 bytes
font_01_sfnt_off000588fb.bin
815a825d72f0a31c37d0eb77c3265de4090284a00fc905588f155117fed36a6b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x588FB 17924 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.