Malicious PDF — malware analysis report

Static analysis result for SHA-256 6dd09650134657ad…

MALICIOUS

PDF

344.7 KB Created: 2015-08-25 22:57:55 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6) First seen: 2021-06-17
MD5: 91ab903ae4961cb5cf75555290ddff84 SHA-1: 1155488cd60182001069c8b3cfc546bce8b798f8 SHA-256: 6dd09650134657ad9ff7c6477921330d33ab302a705bb7c32423bd950a21cd3e
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a link to a known malicious redirector, indicating an attempt to lure the user to a harmful site. The ML classifier also flagged this PDF with high confidence. While no scripts were extracted, the presence of a malicious URL strongly suggests a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=oscar+peterson+%D0%BD%D0%BE%D1%82%D1%8B&charset=utf-8 In PDF document text
    • http://img0.liveinternet.ru/images/attach/c/7//4740/4740954_gdz__po__geometrii_.pdfIn PDF document text
    • http://img1.liveinternet.ru/images/attach/c/7//4741/4741196_skachat__obraz__windows_.pdfIn PDF document text
    • http://img1.liveinternet.ru/images/attach/c/7//4741/4741243_krossvorduy__dlya__detey_.pdfIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00051732.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x51732 9092 bytes
SHA-256: cc45d3687c89da2d914006c15b960500df5a92912566d0bc96ba55cfa155417a
font_01_sfnt_off00052fcd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x52FCD 16892 bytes
SHA-256: f25778a307bcbee42db4e71ae689438e3e4cfe569ec89dcca4f7188631d3b9d3

Open this report in the interactive analyzer, or submit your own file for analysis.