Malicious PDF — malware analysis report

Static analysis result for SHA-256 a467ae79fe729003…

MALICIOUS

PDF

364.7 KB Created: 2015-08-25 11:05:06 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: 72c029e0e093cd0124dcbe21a4ebab7c SHA-1: 97fc44bf51fe944b9f4f30a24156398703974bda SHA-256: a467ae79fe7290039b9deec9bdd532c3c1c1abd22b8f43b7fe90fa5f8753a3cc
68 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a critical heuristic firing for a malicious redirector link, specifically pointing to 'http://botcraftman.ru/'. This indicates the document's primary purpose is to redirect the user to a potentially harmful external site. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the exact lure.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D0%A2%D1%80%D0%B0%D1%84%D0%B0%D1%80%D0%B5%D1%82%D1%8B+%D1%81%D0%B2%D0%B0%D0%B4%D0%B5%D0%B1%D0%BD%D1%8B%D0%B5+%D1%83%D0%B7%D0%BE%D1%80%D1%8B+%D0%BD%D0%B0+%D0%B1%D0%BE%D0%BA%D0%B0%D0%BB%D1%8B&charset=utf-8
    • http://img1.liveinternet.ru/images/attach/c/6//4727/4727185_programmuy__dlya__nokia_.pdf
    • http://img1.liveinternet.ru/images/attach/c/6//4727/4727574_tehnologicheskie__kartuy__blyud_.pdf
    • http://img1.liveinternet.ru/images/attach/c/6//4727/4727976_gdz__po__geografii_.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00057063.bin
b613f6fbe6ae69db0c8c78116637d7a1b9c541f96dba096e9df1a2c329cfcd53		 pdf-font-stream PDF embedded font (sfnt) at offset 0x57063 8344 bytes
font_01_sfnt_off000588c5.bin
32f1d1cf8f5411883c1c3458cadd581586ab39b16883433735a3111a8f346c36		 pdf-font-stream PDF embedded font (sfnt) at offset 0x588C5 13424 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.