Malicious PDF — malware analysis report

Static analysis result for SHA-256 a1aff5c3d7f6d2c6…

MALICIOUS

PDF

350.0 KB Created: 2015-08-20 11:20:07 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: 096b013042eb766953eaadda0366b132 SHA-1: 94588799a7d265a118efa51556d02393bc4a6096 SHA-256: a1aff5c3d7f6d2c6b8b0c1741ff9dcbd6bd4e72294f5109d6db0526b76638a68
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link to a known malicious redirector, http://botcraftman.ru/, which is a strong indicator of malicious intent. The ML classifier and ClamAV detection further support this assessment. The presence of embedded URLs and the PDF structure suggest this file is designed to lure users to a compromised site, likely for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9979

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Dropper.Agent-8788738-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-8788738-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=Fast+for+word+%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE+2013&charset=utf-8
    • http://img1.liveinternet.ru/images/attach/c/6//4639/4639218_spotlight_test_booklet_8_klass.pdf
    • http://img1.liveinternet.ru/images/attach/c/6//4639/4639133_filtr_maslyanaya_kraska_fotoshop_skachat.pdf
    • http://img1.liveinternet.ru/images/attach/c/6//4639/4639644_shablonuy_prezentaciy_s_yubileem_powerpoint.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000528af.bin
d4818df3c1608523bb2fa395a36095c4f45e791ce703ae40ff543bf737c75df7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x528AF 9636 bytes
font_01_sfnt_off000543e1.bin
504e7807b746ef28aa09c774dc8a3560b07cdbfd1ba51876f7dd100a4b2295c9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x543E1 17372 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.