Malicious PDF — malware analysis report

Static analysis result for SHA-256 8c16c12cf21b741d…

MALICIOUS

PDF

384.6 KB Created: 2015-08-24 01:48:29 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: 471dac362f0300af850cd305da442d5d SHA-1: 779b20c8d171d3fcf392b6945a9c85ffe33b8d95 SHA-256: 8c16c12cf21b741d96119bec7cf29e294a7051954d3078b7ec3d14cd6fdd2850
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link to a known malicious redirector, http://botcraftman.ru/. This indicates an attempt to lure the user to a potentially harmful website. The document body, though heavily obfuscated, contains keywords related to 'mount and blade warband', suggesting a lure to download or access game-related content. No scripts were extracted from this sample.

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=mount+and+blade+warband+gain+197+%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+%D1%82%D0%BE%D1%80%D1%80%D0%B5%D0%BD%D1%82&charset=utf-8
    • http://img1.liveinternet.ru/images/attach/c/6//4695/4695443_rukovodstvo__po__remontu_.pdf
    • http://img1.liveinternet.ru/images/attach/c/6//4695/4695553_canoscan__lide__25_.pdf
    • http://img1.liveinternet.ru/images/attach/c/6//4695/4695278_skachat__igru__stilnuye_.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0005b417.bin
289b1efc6025eb9261c9d8817bc3a84520ac9b3c649c0d7c421964a49fb9621b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5B417 10012 bytes
font_01_sfnt_off0005cfef.bin
ca0ab28bf02cc265fdd6512814fa3739ba65b3ce848a5cc0752d8ea2cf64d8a2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5CFEF 16656 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.