Malicious PDF — malware analysis report

Static analysis result for SHA-256 8d5a46472e66b38b…

MALICIOUS

PDF

374.8 KB Created: 2015-08-19 16:01:35 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6) First seen: 2021-10-31
MD5: 2a999edbbc2b8fe91f76229dcaeb21f8 SHA-1: 10cd6ea9976edb34b7c37b94e09cf029ad66686b SHA-256: 8d5a46472e66b38b8a4065e4a3952a3e9d5b0f18433b6da5aaff609aadf7ccac
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a link to a known malicious redirector, botcraftman.ru, which is a strong indicator of malicious intent. The ML classifier also flagged this PDF with high confidence. While no scripts were extracted, the presence of a malicious URL suggests the document is designed to lure the user to a compromised site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9974

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=Test+drive+unlimited+%D0%BF%D0%B5%D1%80%D0%B5%D0%B3%D0%BE%D0%BD+%D0%BC%D0%B0%D1%88%D0%B8%D0%BD+%D0%BA%D0%B0%D1%80%D1%82%D0%B0&charset=utf-8 In PDF document text
    • http://img1.liveinternet.ru/images/attach/c/6//4627/4627664_vozrast_schastya_vladimir_yakovlev_skachat.pdfIn PDF document text
    • http://img0.liveinternet.ru/images/attach/c/6//4626/4626819_skachat_unturned_300_cherez_torrent.pdfIn PDF document text
    • http://img1.liveinternet.ru/images/attach/c/6//4627/4627350_love_city_3d_vzlom_na_vip_status.pdfIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00058d31.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x58D31 10120 bytes
SHA-256: 6915a11fcd96df0e34af979e8e16b9cb943e94cb7b01364b3e4004be9d83b82a
font_01_sfnt_off0005aa5c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5AA5C 16132 bytes
SHA-256: b3b88ceb02bb682d077a58b652aa20905c6fbee430dc90009b70bb4f383fa57a

Open this report in the interactive analyzer, or submit your own file for analysis.