Malicious PDF — malware analysis report

Static analysis result for SHA-256 95d31735e89556ce…

MALICIOUS

PDF

361.3 KB Created: 2015-08-28 20:03:55 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: 8f6b0c9d6a26a029b4c2952febb19d76 SHA-1: 6457dceb47253de29955105e201b892ddbe9fda0 SHA-256: 95d31735e89556ce385847d3c4ee2967f37541ce11a8ae8e5e75c83486a044a1
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was identified as malicious due to a critical heuristic firing for a redirector link. The embedded URL http://botcraftman.ru/ points to known malicious infrastructure, suggesting the document is designed to lure users to a harmful site. No scripts were extracted, and the document body was heavily truncated, limiting further analysis of the specific lure.

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D1%81%D1%86%D0%B5%D0%BD%D0%B0%D1%80%D0%B8%D0%B9+%D0%BD%D0%B0+%D1%8E%D0%B1%D0%B8%D0%BB%D0%B5%D0%B9+%D0%B6%D0%B5%D0%BD%D1%89%D0%B8%D0%BD%D0%B5+75+%D0%BB%D0%B5%D1%82&charset=utf-8
    • http://img1.liveinternet.ru/images/attach/c/7//4809/4809379_skachat__operu__dlya_.pdf
    • http://img0.liveinternet.ru/images/attach/c/7//4810/4810710_pretenziya__ot__yuridicheskogo_.pdf
    • http://img1.liveinternet.ru/images/attach/c/7//4811/4811559_taubau__na__russkom_.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000560c6.bin
17d025106fe3cc06578ab863c9d38a3d28cc83f9bd7540649d2a21a19e0e7600		 pdf-font-stream PDF embedded font (sfnt) at offset 0x560C6 8400 bytes
font_01_sfnt_off00057911.bin
b3ab9498d0d980266bb90da42a4d40e7dc2ad4f414b3cfb0b0e12d48b2d7a391		 pdf-font-stream PDF embedded font (sfnt) at offset 0x57911 14100 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.