Malicious PDF — malware analysis report

Static analysis result for SHA-256 7177456ca737771a…

MALICIOUS

PDF

361.7 KB Created: 2015-08-29 03:43:18 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: 56da5baaed554e253c215b8435aad2a0 SHA-1: 6c98ba53036326e56c007fb389b63c7948edbece SHA-256: 7177456ca737771a2feb514a4f5389f674fae43bf1f088fe5821b0187b9c2d8b
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically identified as a dropper. A critical heuristic firing indicates the presence of a link to known malicious redirector infrastructure at http://botcraftman.ru/. This suggests the document's primary purpose is to lure the user into clicking the link, which likely leads to the download and execution of a secondary malicious payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9978

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Dropper.Agent-8901075-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-8901075-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D0%BF%D1%80%D0%B8%D0%BB%D0%BE%D0%B6%D0%B5%D0%BD%D0%B8%D0%B5+%D0%B4%D0%BB%D1%8F+%D0%BE%D1%82%D0%BF%D1%80%D0%B0%D0%B2%D0%BA%D0%B8+%D1%81%D0%BC%D1%81+%D1%87%D0%B5%D1%80%D0%B5%D0%B7+%D0%B8%D0%BD%D1%82%D0%B5%D1%80%D0%BD%D0%B5%D1%82&charset=utf-8
    • http://img0.liveinternet.ru/images/attach/c/7//4818/4818665_skachat__siti__info_.pdf
    • http://img0.liveinternet.ru/images/attach/c/7//4818/4818938_dasha__sledopuyt__skachat_.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0005649a.bin
9d31c382c0b7f6733b79e68c3dd430f6e1858311adf3922169fa2e0096554267		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5649A 8376 bytes
font_01_sfnt_off00057d46.bin
ddc89c39e32bf61ea1230d0e87a939261484b1c94f139eb7f5a0f747650195bd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x57D46 13308 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.