Malicious PDF — malware analysis report

Static analysis result for SHA-256 659208bf06147d6a…

MALICIOUS

PDF

373.0 KB Created: 2015-08-28 11:28:39 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: 94919d542a346036e733128cbc0e601e SHA-1: c01588a8041eaff36387caa7d4a8a276c326e0f2 SHA-256: 659208bf06147d6af60730d10a26d9dede20aa121540eb122d42ab9abbaf22b0
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a link to known malicious redirector infrastructure, indicating an attempt to lure the user to a harmful site. The ML classifier also flagged this PDF with high confidence. No scripts were extracted, but the embedded URL is the primary indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9974

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D0%B8%D0%BC%D0%BF%D0%B5%D1%80%D0%B8%D1%8F+%D0%B0%D0%BD%D0%B3%D0%B5%D0%BB%D0%BE%D0%B2+%D0%B1%D0%B5%D1%80%D0%BD%D0%B0%D1%80%D0%B4+%D0%B2%D0%B5%D1%80%D0%B1%D0%B5%D1%80+%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C&charset=utf-8
    • http://img0.liveinternet.ru/images/attach/c/7//4796/4796323_kalendarnuyy__plan__muzuykalnuyh_.pdf
    • http://img0.liveinternet.ru/images/attach/c/7//4798/4798359_programmirovanie__v__1s_.pdf
    • http://img0.liveinternet.ru/images/attach/c/7//4790/4790172_pesnya__vasilisuy__iz_.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0005910d.bin
59e12f42e465d9af4b0b1226193af5d8c62dfbf08bb577909bb0a2c5a04f0e15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5910D 8948 bytes
font_01_sfnt_off0005a9c8.bin
911296900d46d0f46314f9fa727ca8c90f577e35936b16193705701843d8a07a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5A9C8 13280 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.