Malicious PDF — malware analysis report

Static analysis result for SHA-256 606804e16ebd88d5…

MALICIOUS

PDF

362.1 KB Created: 2015-08-26 15:00:39 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: 0cda76f8fbed0e550b245e56d0023396 SHA-1: adaad9141d3d4c9c8b735017b28db2263a311ed6 SHA-256: 606804e16ebd88d558fcc8ea13ed7d1ce0f16550045f298810d86d6363e569d8
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a link to a known malicious redirector infrastructure, indicating an attempt to lure the user to a harmful site. The ML classifier also flagged this PDF with high confidence. While no scripts were explicitly extracted, the presence of embedded URLs and the nature of the heuristic firings suggest a malicious intent to redirect the user.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9979

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D0%BA%D0%BB%D1%8E%D1%87+%D0%B4%D0%BB%D1%8F+%D0%B8%D0%B3%D1%80%D1%8B+venus+hostage&charset=utf-8
    • http://img1.liveinternet.ru/images/attach/c/7//4757/4757269_skachat__zvuk_.pdf
    • http://img0.liveinternet.ru/images/attach/c/7//4752/4752788_kak__skachat__prilozheniya_.pdf
    • http://img0.liveinternet.ru/images/attach/c/7//4756/4756382_mocart__skachat__sbornik_.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00055bd3.bin
a94bc26e6e495712093676808ec50296732a22e2de55f44ae1f1a86a2b353fe8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x55BD3 10296 bytes
font_01_sfnt_off00057820.bin
9ff1ff9f4a6a4c3624e6bf4cdede0f083bedcd95ad3fd41c471df47d31683da2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x57820 16140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.