Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ae3bdd5fd5c3fd3…

MALICIOUS

PDF

390.6 KB Created: 2015-08-24 05:47:30 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: eb023a91ec97790aa7746a8b92849820 SHA-1: e28d37a96146206563f4c69e8e903e80b140bc3e SHA-256: 6ae3bdd5fd5c3fd3dbac091f93808e502d2ceae49c99436ecd71f4c2a4b07f87
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a link to a known malicious redirector, indicating an attempt to lure the user to a harmful site. The ML classifier also strongly flagged this PDF as malicious. While no scripts were explicitly extracted, the PDF structure and embedded link suggest a phishing or malware distribution vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9951

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+%D0%BA%D0%BD%D0%B8%D0%B3%D1%83+%D0%BC%D0%B5%D1%82%D0%BB%D0%B8%D0%BD%D0%B0+%D0%BA%D0%BE%D0%BD%D1%81%D0%BF%D0%B5%D0%BA%D1%82%D1%8B+%D0%B7%D0%B0%D0%BD%D1%8F%D1%82%D0%B8%D0%B9+%D0%BF%D0%BE+%D0%BC%D0%B0%D1%82%D0%B5%D0%BC%D0%B0%D1%82%D0%B8%D0%BA%D0%B5+%D0%B2+%D0%B4%D0%B5%D1%82%D1%81%D0%BA%D0%BE%D0%BC+%D1%81%D0%B0%D0%B4%D1%83&charset=utf-8
    • http://img0.liveinternet.ru/images/attach/c/6//4694/4694809_testuy__po__angliyskomu_.pdf
    • http://img1.liveinternet.ru/images/attach/c/6//4695/4695870_skachat__igru__pratatip2_.pdf
    • http://img1.liveinternet.ru/images/attach/c/6//4699/4699776_fotoshop__zombi_.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0005d003.bin
3ae51c5b25788985df9eb1c89878513ad45e9675091685d879401400b36992b8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5D003 10808 bytes
font_01_sfnt_off0005ed2a.bin
a44315a10a219d1bd7e63def3b3bf85b9f9d2197c17d2c19ab8581282014ac6f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5ED2A 14276 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.