Malicious PDF — malware analysis report

Static analysis result for SHA-256 a7b152b1558b5409…

MALICIOUS

PDF

366.7 KB Created: 2015-08-19 14:20:08 +03:00 Authoring application: wkhtmltopdf 0.12.2.4 (via Qt 4.8.6)
MD5: 8d90865d982a7af2067805be509d24ba SHA-1: 65904ee96cbb1047b954dc8b01d097d238578809 SHA-256: a7b152b1558b5409bea09f798496d8ebe9ea5c6fe831369f280f9130b3d96c4d
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was detected as malicious by ClamAV and contains a critical heuristic firing for a malicious redirector link. The embedded URL points to 'botcraftman.ru', which is known to host malicious content. The document body appears to be heavily obfuscated or corrupted, preventing a clear understanding of its specific lure, but the presence of the malicious link strongly suggests a phishing or malware delivery attempt.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • ClamAV: Pdf.Dropper.Agent-8788873-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-8788873-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://botcraftman.ru/?lip&keyword=%D0%BC%D0%BE%D0%B4%D1%8B+%D0%BE%D1%82+%D0%B4%D0%B6%D0%BE%D0%B2%D0%B0+%D0%B4%D0%BB%D1%8F+world+of+tanks+0+8+10&charset=utf-8
    • http://img0.liveinternet.ru/images/attach/c/6//4626/4626614_crystal_tv_kod_aktivacii_kanalov_besplatno.pdf
    • http://img0.liveinternet.ru/images/attach/c/6//4626/4626599_skachat_gta_san_andreas_na_android_bez_kesha_besplatno.pdf
    • http://img0.liveinternet.ru/images/attach/c/6//4626/4626505_skachat_formu_rsv1_pfr_za_2_kvartal_2015.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00056ec6.bin
c1e66bc0d9e9cd5a76647a75768bd41cd44c38b3117a2a80fcd164ade6764fab		 pdf-font-stream PDF embedded font (sfnt) at offset 0x56EC6 9712 bytes
font_01_sfnt_off00058aa6.bin
e84ffde07cc98b3ee1b4fb1ce7a581c9d26cfd3575606ba17ec939fcf24c668c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x58AA6 15608 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.