Malicious PDF — malware analysis report

Static analysis result for SHA-256 78fd2737d0e3d0e8…

MALICIOUS

PDF

184.4 KB Created: 2015-07-24 00:12:27 +03:00 Authoring application: wkhtmltopdf 0.12.2.1 (via Qt 4.8.6)
MD5: c601236ae99be35f0e4c3dea9587d49f SHA-1: 92030928b317d0c92628d37a13a3c76defc7ba4d SHA-256: 78fd2737d0e3d0e88015f066bcea1c0aa7a605e7fc5a97cc2a0bfb390010a8d9
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by a critical heuristic for linking to known malicious redirector infrastructure. The ML classifier also assigned a high probability of maliciousness. The embedded URL `http://botcraftman.ru/?lip&keyword=%D0%B4%D0%BD%D0%B5%D0%B2%D0%BD%D0%B8%D0%BA+%D1%82%D1%80%D0%B5%D0%B9%D0%B4%D0%B5%D1%80%D0%B0+%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+xls&charset=utf-8` is the primary indicator of this malicious redirection. No scripts were extracted, limiting further analysis of the payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9982

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D0%B4%D0%BD%D0%B5%D0%B2%D0%BD%D0%B8%D0%BA+%D1%82%D1%80%D0%B5%D0%B9%D0%B4%D0%B5%D1%80%D0%B0+%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+xls&charset=utf-8
    • http://fastpic.ru/
    • http://www.liveinternet.ru/click
    • http://img1.liveinternet.ru/images/attach/c/5//4185/4185265_otvetuy_na_egye_po_biologii_2015.pdf
    • http://img1.liveinternet.ru/images/attach/c/5//4185/4185451_ischeznuvshaya_gillian_flinn_skachat_besplatno.pdf
    • http://img1.liveinternet.ru/images/attach/c/5//4183/4183179_lampovuyy_kombik_shema.pdf

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_048_off0002a4ee.bin
7216a37d8fd5f4533a933240eb7b8247b9411ef01bdebead9cde5184f8e8bfcf		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2A4EE 6640 bytes
font_00_sfnt_off00023e10.bin
880e53e6f12106514012eaabb19a261b9f8ae03d695445fc59a5b9b5a1293281		 pdf-font-stream PDF embedded font (sfnt) at offset 0x23E10 3556 bytes
font_01_sfnt_off00024b93.bin
0a1b8eabc9082459e13f2ab01cebc6e80ff95b67d6f1a5ad80d131c7a4931eda		 pdf-font-stream PDF embedded font (sfnt) at offset 0x24B93 14832 bytes
font_02_sfnt_off000279ff.bin
5833539cb4d606d2c61b805339dd9f6ddbf4dc2b9fbf6e0476add131d07e17e0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x279FF 14532 bytes
font_04_sfnt_off0002b7eb.bin
819f9cc5156bfe3dae03045446d677a19b5879270357875344f9514601da73e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2B7EB 6084 bytes
font_05_sfnt_off0002c780.bin
9364d8c42993f0db1eb41a63b15a48dd56cef5056a611ab8e91dd81183a5a95e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2C780 3752 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.