Malicious PDF — malware analysis report

Static analysis result for SHA-256 64bdff55f4686456…

MALICIOUS

PDF

178.6 KB Created: 2015-08-05 21:41:22 +03:00 Authoring application: wkhtmltopdf 0.12.2.1 (via Qt 4.8.6)
MD5: d1aa14f94761ee25832159f37a5bc31c SHA-1: 5a6ded632704dbd2c930205bab4090cdab4ed5b9 SHA-256: 64bdff55f468645613bc9d9bce10b793c6e3a55cd6bc4bde759310484e7adfbd
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF was flagged by multiple heuristics, including a critical alert for a malicious redirector link pointing to 'http://botcraftman.ru/?lip&keyword=+18++&charset=utf-8'. The ML classifier also strongly indicated maliciousness. This suggests the document's primary purpose is to redirect users to malicious infrastructure, likely as part of a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9976

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Dropper.Agent-9094999-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-9094999-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=+18++&charset=utf-8
    • http://fastpic.ru/
    • http://www.liveinternet.ru/click
    • http://img1.liveinternet.ru/images/attach/c/6//4305/4305001_testuy_po_egye_po_russkomu_yazuyku_11_klass.pdf
    • http://img0.liveinternet.ru/images/attach/c/6//4304/4304554_igrat_sims_4_besplatno.pdf
    • http://img0.liveinternet.ru/images/attach/c/6//4306/4306601_diplomaticheskie_nomera_koduy.pdf
    • http://www.microsoft.com/typography/fonts/
    • http://www.microsoft.com/typography/fonts/You

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00022f14.bin
880e53e6f12106514012eaabb19a261b9f8ae03d695445fc59a5b9b5a1293281		 pdf-font-stream PDF embedded font (sfnt) at offset 0x22F14 3556 bytes
font_01_sfnt_off00023c97.bin
ef27f053e8e9acc7f8ba93e85b72e00745e7f1f1105a1ff09ee1f0e18ff02b11		 pdf-font-stream PDF embedded font (sfnt) at offset 0x23C97 13612 bytes
font_02_sfnt_off000267a3.bin
d52a48a751b8b1b7ee0e66091b0bcd71be61d5495dec22afc44e3b443be247e9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x267A3 14468 bytes
font_03_sfnt_off00029256.bin
c01168cbf913c1a61fdebd05439106eede9c7b5a43ce24243fd7c78294b2e634		 pdf-font-stream PDF embedded font (sfnt) at offset 0x29256 5384 bytes
font_04_sfnt_off0002a0a9.bin
819f9cc5156bfe3dae03045446d677a19b5879270357875344f9514601da73e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2A0A9 6084 bytes
font_05_sfnt_off0002b03e.bin
9364d8c42993f0db1eb41a63b15a48dd56cef5056a611ab8e91dd81183a5a95e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2B03E 3752 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.